<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="72">
<package pkgid="dc9e9ccd43757b74dbbfc280cd1b4c2c983974e405f1f31a0698bd2cdd49daceb2394e1d2178471764515c5060aa92a05a68811b10076398e48156e13801b963" name="python-Routes" arch="src">
  <version epoch="0" ver="2.5.1" rel="56.7"/>
  <changelog author="saschpe@suse.de" date="1314878400">- Initial version</changelog>
  <changelog author="saschpe@suse.de" date="1314878401">- Removed reStructuredText markup from description</changelog>
  <changelog author="saschpe@suse.de" date="1314878402">- Fix license to BSD-3-Clause (SPDX style)</changelog>
  <changelog author="bwiedemann@suse.com" date="1327406400">- Fix Obsoletes</changelog>
  <changelog author="saschpe@suse.de" date="1331726400">- Update to version 1.13:
  * Fix bug with dots forcing extension by default. The portion with the dot
    can now be recognized. Patch by Michael Basnight.
- Simplified macro usage</changelog>
  <changelog author="saschpe@suse.de" date="1334577600">- Require python-repoze.lru</changelog>
  <changelog author="speilicke@suse.com" date="1382616000">- Require python-setuptools instead of distribute (upstreams merged)</changelog>
  <changelog author="tbechtold@suse.com" date="1429531200">- update to 2.1:
  * Fix 3 other route matching groups in route.py to use anonymous groups for
    optional sections to avoid exceeding regex limits. Fixes #15.
  * Printing a mapper now includes the Controller/action parameters from the
    route. Fixes #11.
  * Fix regression that didn't allow passing in params 'host', 'protocol', or
    'anchor'. They can now be passed in with a trailing '_' as was possible
    before commit d1d1742903fa5ca24ef848a6ae895303f2661b2a. Fixes #7.
  * URL generation with/without SCRIPT_NAME was resulting in the URL cache
    failing to return the appropriate cached URL generation. The URL cache
    should always include the SCRIPT_NAME, even if its empty, in the cache
    to avoid this, and now does. Fixes #6.
  * Extract Route creation into separate method in Mapper.  Subclasses of Route
    can be created by Mappers now.
  * Use the first X_FORWARDED_FOR value if there are multiple proxies in the
    path. Fixes #5.
  * Python 3.2/3.3 Support. Fixes Issue #2. Thanks to Alejandro Sánchez for
    the pull request!
- Enable testrun during build and adjust BuildRequires for that.
- Adjust documentation links.</changelog>
  <changelog author="hpj@urpla.net" date="1438948800">- update to 2.2:
  * Fix Python 3 support. Patch by Victor Stinner.
- spell python-WebTest and python-WebOb correctly</changelog>
  <changelog author="tbechtold@suse.com" date="1464955200">- update to 2.3.1:
  * Backwards compatability fix - connect should work with mandatory
    routename and optional path. Patch by Davanum Srinivas (PR #65).
  * Fix sub_domain equivalence check. Patch by Nikita Uvarov
  * Add support for protocol-relative URLs generation (i.e. starting with double
    slash ``//``). PR #60. Patch by Sviatoslav Sydorenko.
  * Add support for the ``middleware`` extra requirement, making possible to
    depend on ``webob`` optionally. PR #59. Patch by Sviatoslav Sydorenko.
  * Fix matching of an empty string route, which led to exception in earlier
    versions. PR #58. Patch by Sviatoslav Sydorenko.
  * Add support for the ``requirements`` option when using
    mapper.resource to create routes. PR #57. Patch by Sean Dague.
  * Concatenation fix when using submappers with path prefixes. Multiple
    submappers combined the path prefix inside the controller argument in
    non-obvious ways. The controller argument will now be properly carried
    through when using submappers. PR #28.</changelog>
  <changelog author="tbechtold@suse.com" date="1498737600">- update to 2.4.1:
  * Release as a universal wheel. PR #75.
  * Convert readthedocs links for their .org -&gt; .io migration for hosted projects.
- convert to singlespec
- Fix Source url</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1543924800">- Remove superfluous devel dependency for noarch package</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1573128000">- Run through spec-cleaner</changelog>
  <changelog author="pgajdos@suse.com" date="1592395200">- nose -&gt; pytest</changelog>
  <changelog author="Dirk Mueller &lt;dmueller@suse.com&gt;" date="1606392000">- update to 2.5.1:
  * Add compatibility for Python 3.7+.
  * Add graceful fallback for invalid character encoding from request object.
  * Enhanced performance for matching routes that share the same static prefix.
  * Fixed issue with child routes not passing route conditions to the Mapper.connect call.
  * Fixed documentation to reflect default value for minimization.
  * Allow backslash to escape special characters in route paths.
  * Resolve invalid escape sequences.
  * Remove support for Python 2.6, 3.3, and 3.4.
  * Remove obsolete Python 2.3 compat code.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1636372800">- add six dependency declaration</changelog>
  <changelog author="Ben Greiner &lt;code@bnavigator.de&gt;" date="1660824000">- Clean specfile, remove coverage</changelog>
  <changelog author="Mark&#xE9;ta Machov&#xE1; &lt;mmachova@suse.com&gt;" date="1717761600">- Add remove-six.patch to get rid of six</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1750766400">- Switch to pyproject macros.</changelog>
</package>
<package pkgid="df1a994f5d563312267eb9d3103bca497380857bd1e9e1019d3ab55bced7cdb8ebb210a7f3178bff5055f3f4ab1002668bf4d31f57c3a10de3af25020164e83e" name="python-asyncssh" arch="src">
  <version epoch="0" ver="2.23.1" rel="75.1"/>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1643371200">- Update to 2.9.0:
  - Added mypy-compatible type annotations to all AsyncSSH
    modules, and a "py.typed" file to signal that annotations are
    now available for this package.
  - Added experimental support for SFTP versions 4-6. While
    AsyncSSH still defaults to only advertising version 3 when
    acting as both a client and a server, applications can
    explicitly enable support for later versions, which will be
    used if both ends of the connection agree. Not all features
    are fully supported, but a number of useful enhancements are
    now available, including as users and groups specified by
    name, higher resolution timestamps, and more granular error
    reporting.
  - Updated documentation to make it clear that keys from
    a PKCS11 provider or ssh-agent will be used even when
    client_keys is specified, unless those sources are explicitly
    disabled.
  - Improved handling of task cancellation in AsyncSSH to
    avoid triggering an error of "Future exception was never
    retrieved". Thanks go to Krzysztof Kotlenga for reporting
    this issue and providing test code to reliably reproduce it.
  - Changed implementation of OpenSSH keepalive handler to
    improve interoperability with servers which don't expect a
    "success" response when this message is sent.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1643630400">- Skip more tests that are unstable.</changelog>
  <changelog author="Otto Hollmann &lt;otto.hollmann@suse.com&gt;" date="1659614400">- Update to 2.11.0:
  * Made a number of improvements in SFTP glob support, with thanks to Github
    user LuckyDams for all the help working out these changes!
  * Added a new glob_sftpname() method which returns glob matches together
    with attribute information, avoiding the need for a caller to make
    separate calls to stat() on the returned results.
  * Switched from listdir() to scandir() to reduce the number of stat()
    operations required while finding matches.
  * Added code to remove duplicates when glob() is called with multiple
    patterns that match the same path.
  * Added a cache of directory listing and stat results to improve performance
    when matching patterns with overlapping paths.
  * Fixed an "index out of range" bug in recursive glob matching and aligned
    it better with results reeturned by UNIX shells.
  * Changed matching to ignore inaccessible or non-existent paths in a glob
    pattern, to allow accessible paths to be fully explored before returning
    an error. The error handler will now be called only if a pattern results
    in no matches, or if a more serious error occurs while scanning.
  * Changed SFTP makedirs() method to work better cases where parts of requested
    path already exist but don't allow read access. As long as the entire path
    can be created, makedirs() will succeed, even if some directories on the
    path don't allow their contents to be read. Thanks go to Peter Rowlands for
    providing this fix.
  * Replaced custom Diffie Hellman implementation in AsyncSSH with the one in
    the cryptography package, resulting in an over 10x speedup. Thanks go to
    Github user iwanb for suggesting this change.
  * Fixed AsyncSSH to re-acquire GSS credentials when performing key
    renegotiation to avoid expired credentials on long-lived connections. Thanks
    go to Github user PromyLOPh for pointing out this issue and suggesting a fix.
  * Fixed GSS MIC to work properly with GSS key exchange when AsyncSSH is
    running as a server. This was previously fixed on the client side, but a
    similar fix for the server was missed.
  * Changed connection timeout unit tests to work better in environments where a
    firewall is present. Thanks go to Stefano Rivera for reporting this issue.
  * Improved unit tests of Windows SSPI GSSAPI module.
  * Improved speed of unit tests by reducing the number of key generation calls.
    RSA key generation in particular has gotten much more expensive in OpenSSL 3.
- Changes from 2.10.1:
  * Added a workaround for a bug in dropbear which can improperly reject
    full-sized data packets when compression is enabled. Thanks go to Matti
    Niemenmaa for reporting this issue and helping to reproduce it.
  * Added support for "Match Exec" in config files and updated AsyncSSH API
    calls to do config parsing in an executor to avoid blocking the event loop
    if a "Match Exec" command doesn't return immediately.
  * Fixed an issue where settings associated with server channels set when
    creating a listener rather than at the time a new channel is opened were not
    always being applied correctly.
  * Fixed config file handling to be more consistent with OpenSSH, making all
    relative paths be evaluated relative to ~/.ssh and allowing references to
    config file patterns which don't match anything to only trigger a debug
    message rather than an error. Thanks go to Caleb Ho for reporting this issue!
  * Updated minimum required version of cryprography package to 3.1, to allow
    calls to it to be made without passing in a "backend" argument. This was
    missed back in the 2.9 release. Thanks go to Github users sebby97 and
    JavaScriptDude for reporting this issue!
- Changes from 2.10.0:
  * Added new get_server_auth_methods() function which returns the set of auth
    methods available for a given user and SSH server.
  * Added support for new line_echo argument when creating a server channel
    which controls whether input in the line editor is echoed to the output
    immediately or under the control of the application, allowing more control
    over the ordering of input and output.
  * Added explicit support for RSA SHA-2 certificate algorithms. Previously
    SHA-2 signatures were supported using the original
    ssh-rsa-cert-v01@openssh.com algorithm name, but recent versions of SSH now
    disable this algorithm by default, so the new SHA-2 algorithm names need to
    be advertised for SHA-2 signatures to work when using OpenSSH certificates.
  * Improved handling of config file loading when options argument is used
    allowing config loading to be overridden at connect() time even if the
    options passed in referenced a config file.
  * Improved speed of unit tests by avoiding some network timeouts when
    connecting to invalid addresses.
  * Merged GitHub workflows contributed by GitHub user hexchain to run unit
    tests and collect code coverage information on multiple platforms and Python
    versions. Thanks so much for this work!
  * Fixed issue with GSS auth unit tests hanging on Windows.
  * Fixed issue with known_hosts matching when ProxyJump is being used. Thanks
    go to GitHub user velavokr for reporting this and helping to debug it.
  * Fixed type annotations for SFTP client and server open methods. Thanks go to
    Marat Sharafutdinov for reporting this!</changelog>
  <changelog author="Yogalakshmi Arunachalam &lt;yarunachalam@suse.com&gt;" date="1663934400">- Update to 2.12.0
  * Fix an issue with SFTP servers which don't support random access I/O
  * Fix "Recceived window change" in log message (#509)
  * Fix forwarding a dynamically allocated port in the server (#512)
  * Fix type of SSHServerProcessFactory
  * Bump version number up to 2.12.0 and update change log</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1672920000">- update to 2.13.0:
  * Updated testing and coverage to drop Python 3.6 and add Python 3.11.
  * Added new "recv_eof" option to not pass an EOF from a channel to a
    redirected target, allowing output from multiple SSH sessions to be
    sent and mixed with other direct output to that target.
  * Added new methods to make it easy to perform forwarding between TCP
    ports and UNIX domain sockets.
  * Added a workaround for a problem seen on a Huawei SFTP server where
    it sends an invalid combination of file attribute flags.
  * Fixed an issue with copying files to SFTP servers that don't support
    random access I/O.
  * Fixed an issue when requesting remote port forwarding on a dynamically
    allocated port.
  * Fixed an issue where readexactly could block indefinitely when a signal
    is delivered in the stream before the requested number of bytes are
    available.
  * Fixed an interoperability issue with OpenSSH when using SSH certificates
    with RSA keys with a SHA-2 signature.
  * Fixed an issue with handling "None" in ProxyCommand, GlobalKnownHostsFile,
    and UserKnownHostsFile config file options.</changelog>
  <changelog author="Daniel Garcia &lt;daniel.garcia@suse.com&gt;" date="1674648000">- Add remove-sha1.patch to make it compatible with latests versions of
  cryptography gh#ronf/asyncssh@fae5a9e8baad</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1678104000">- update to 2.13.1:
  * Updated type definitions for mypy 1.0.0, removing a
    dependency on implicit Optional types, and working around an
    issue that could trigger a mypy internal error.
  * Updated unit tests to avoid calculation of SHA-1 signatures,
    which are no longer allowed in cryptography 39.0.0.
- drop remove-sha1.patch (upstream)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1688212800">- update to 2.13.2:
  * Fixed an issue with host-based authentication when using
    proxy_command, allowing it to be used if the caller
    explicitly specifies client_host.
  * Improved handling of signature algorithms for OpenSSH
    certificates so that RSA SHA-2 signatures will work with
    both older and newer versions of OpenSSH.
  * Worked around an issue with some Cisco SSH implementations
    generating invalid "ignore" packets.
  * Fixed unit tests to avoid errors when cryptography's version
    of * OpenSSL disables support for SHA-1 signatures.
  * Fixed unit tests to avoid errors when the filesystem enforces
    that filenames be valid UTF-8 strings.
  * Added documentation about which config options apply when
    passing a string as a tunnel argument.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1696507200">- update to 2.14.0:
  * Added support for a new accept_handler argument when setting
    up local port forwarding, allowing the client host and port to
    be validated and/or logged for each new forwarded connection.
  * Added an option to disable expensive RSA private key checks
    when using OpenSSL 3.x. Functions that read private keys have
    been modified to include a new unsafe_skip_rsa_key_validation
    argument which can be used to avoid these additional checks,
    if you are loading keys from a trusted source.
  * Added host information into AsyncSSH exceptions when host key
    validation fails, and a few other improvements related to
    X.509 certificate validation errors.
  * Fixed a regression which prevented keys loaded into an SSH
    agent with a certificate from working correctly beginning in
    AsyncSSH after version 2.5.0.
  * Fixed an issue which was triggering an internal exception
    when shutting down server sessions with the line editor enabled
    which could cause some output to be lost on exit, especially when
    running on Windows.
  * Fixed a documentation error in SSHClientConnectionOptions and
    SSHServerConnectionOptions.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1699617600">- update to 2.14.1 (bsc#1217028, CVE-2023-46445):
  * Hardened AsyncSSH state machine against potential message
    injection attacks, described in more detail in
    `CVE-2023-46445 and CVE-2023-46446
  * Added support for passing in a regex in readuntil in
    SSHReader,
  * Added support for get_addresses() and get_port() methods on
  * SSHAcceptor.
  * Fixed an issue with AsyncFileWriter potentially writing data
  * out of order.
  * Updated testing to include Python 3.12.
  * Updated readthedocs integration to use YAML config file.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1702900800">- update to 2.14.2 (bsc#1218165, CVE-2023-48795):
  * Implemented "strict kex" support and other countermeasures to
  * protect against the Terrapin Attack described in
    CVE-2023-48795
  * Fixed config parser to properly an optional equals delimiter
    in all config arguments.
  * Fixed TCP send error handling to avoid race condition when
    receiving incoming disconnect message.
  * Improved type signature in SSHConnection async context
    manager.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1723204800">- update to 2.15.0:
  * Added experimental support for tunneling of TUN/TAP network
    interfaces on Linux and macOS, allowing for either automatic
    packet forwarding or explicit reading and writing of packets
    sent through the tunnel by the application. Both callback and
    stream APIs are available.
  * Added support for forwarding terminal size and terminal size
    changes when stdin on an SSHServerProcess is redirected to a
    local TTY.
  * Added support for multiple tunnel/ProxyJump hosts. Thanks go
    to Adam Martin for suggesting this enhancement and proposing
    a solution.
  * Added support for OpenSSH lsetstat SFTP extension to set
    attributes on symbolic links on platforms which support that
    and use it to improve symlink handling in the SFTP get, put,
    and copy methods. In addition, a follow_symlinks option has
    been added on various SFTPClient methods which get and set
    these attributes. Thanks go to GitHub user eyalgolan1337 for
    reporting this issue.
  * Added support for password and passphrase arguments to be a
    callable or awaitable, called when performing authentication
    or loading encrypted private keys. Thanks go to GitHub user
    goblin for suggesting this enhancement.
  * Added support for proper flow control when using
    AsyncFileWriter or StreamWriter classes to do SSH process
    redirection. Thanks go to Benjy Wiener for reporting this
    issue and providing feedback on the fix.
  * Added is_closed() method
    SSHClientConnection/SSHServerConnection to return whether the
    associated network connection is closed or not.
  * Added support for setting and matching tags in OpenSSH config
    files.
  * Added an example of using "await" in addition to "async with"
    when opening a new SSHClientConnection. Thanks go to Michael
    Davis for suggesting this added documentation.
  * Improved handling CancelledError in SCP, avoiding an issue
    where AsyncSSH could sometimes get stuck waiting for the
    channel to close. Thanks go to Max Orlov for reporting the
    problem and providing code to reproduce it.
  * Fixed a regression from 2.14.1 related to rekeying an SSH
    connection when there's acitivty on the connection in the
    middle of rekeying. Thanks go to GitHub user eyalgolan1337
    for helping to narrow down this problem and test the fix.
  * Fixed a problem with process redirection when a close is
    received without a preceding EOF. Thanks go to GitHub user
    xuoguoto who helped to provide sample scripts and ran tests
    to help track this down.
  * Fixed the processing of paths in SFTP client symlink
    requests. Thanks go to André Glüpker for reporting the
    problem and providing test code to demonstrate it.
  * Fixed an OpenSSH config file parsing issue. Thanks go to
    Siddh Raman Pant for reporting this issue.
  * Worked around a bug in a user auth banner generated by the
    cryptlib library. Thanks go to GitHub user mmayomoar for
    reporting this issue and suggesting a fix.</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1727352000">- update to 2.17.0:
  * Add support for specifying a per-connection credential store
    for GSSAPI authentication.
  * Fixed a regression introduced in AsyncSSH 2.15.0 which could
    cause connections to be closed with an uncaught exception when
    a session on the connection was closed.
  * Added a workaround where getaddrinfo() on some systems may
    return duplicate entries, causing bind() to fail when opening
    a listener.
  * Relaxed padding length check on OpenSSH private keys to
    provide better compatibility with keys generated by PuTTYgen.
  * Improved documentation on SSHClient and SSHServer classes to
    explain when they are created and their relationship to the
    SSHClientConnection and SSHServerConnection classes.
  * Updated examples to use Python 3.7 and made some minor
    improvements.
- update to 2.16.0:
  * Added client and server support for the OpenSSH "hostkeys"
    extension. When using known_hosts, clients can provide a
    handler which will be called with the changes between the
    keys currently trusted in the client's known hosts and those
    available on the server. On the server side, an application
    can choose whether or not to enable the sending of this host
    key information.
  * Related to the above, AsyncSSH now allows the configuration of
    multiple server host keys of the same type when the
    send_server_host_keys option is enabled. Only the first key of
    each type will be used in the SSH handshake, but the others can
    appear in the list of supported host keys for clients to begin
    trusting, allowing for smoother key rotation.
  * Fixed logging and typing issues in SFTP high-level copy
    functions. A mix of bytes, str, and PurePath entries are now
    supported in places where a list of file paths is allowed, and
    the type signatures have been updated to reflect that the
    functions accept either a single path or a list of paths.
  * Improved typing on SFTP listdir() function.
  * Reworked the config file parser to improve on a previous fix
    related to handling key/value pairs with an equals delimiter.
  * Improved handling of ciphers deprecated in cryptography 43.0.0.
  * Improved support for use of Windows pathnames in ProxyCommand.</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1730980800">- Update to 2.18.0
  * Added support for post-quantum ML-KEM key exchange algorithms,
    interoperable with OpenSSH 9.9.
  * Added support for the OpenSSH "limits" extension, allowing the
    client to query server limits such as the maximum supported read
    and write sizes. The client will automatically default to the reported
    maximum size on servers that support this extension.
  * Added more ways to specify environment variables via the `env` option.
    Sequences of either 'key=value' strings or (key, value) tuples are now
    supported, in addition to a dict.
  * Added support for getting/setting environment variables as byte strings
    on platforms which support it. Previously, only Unicode strings were
    accepted and they were always encoded on the wire using UTF-8.
  * Added support for non-TCP sockets (such as a socketpair) as the `sock`
    parameter in connect calls. Thanks go to Christian Wendt for reporting
    this problem and proposing a fix.
  * Changed compression to be disabled by default to avoid it becoming a
    performance bottleneck on high-bandwidth connections. This now also
    matches the OpenSSH default.
  * Improved speed of parallelized SFTP reads when read-ahead goes beyond
    the end of the file. Thanks go to Maximilian Knespel for reporting
    this issue and providing performance measurements on the code before
    and after the change.
  * Improved cancellation handling during SCP transfers.
  * Improved support for selecting the currently available security key
    when the application lists multiple keys to try. Thanks go to GitHub
    user zanda8893 for reporting the issue and helping to work out the
    details of the problem.
  * Improved handling of reverse DNS failures in host-based authentication.
    Thanks go to GitHub user xBiggs for suggesting this change.
  * Improved debug logging of byte strings with non-printable characters.
  * Switched to using an executor on GSSAPI calls to avoid blocking the
    event loop.
  * Fixed handling of "UserKnownHostsFile none" in config files. This
    previously caused it to use the default known hosts, rather than
    disabling known host checking.
  * Fixed a runtime warning about not awaiting a coroutine in unit tests.
  * Fixed a unit test failure on Windows when calling abort on a transport.
  * Fixed a problem where a "MAC verification failed" error was sometimes
    sent on connection close.
  * Fixed SSHClientProcess code to not raise a runtime exception when
    waiting more than once for a process to finish. Thanks go to GitHub
    user starflows for reporting this issue.
  * Handled an error when attempting to import older verions of pyOpenSSL.
    Thanks go to Maximilian Knespel for reporting this issue and testing
    the fix.
  * Updated simple_server example code to switch from crypt to bcrypt,
    since crypt has been removed in Python 3.13. Thanks go to Colin
    Watson for providing this update.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1749816000">- Switch to pyproject macros.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1752321600">- update to 2.21.0:
  * Added sparse file support for SFTP, allowing file copying
    which automatically skips over any "holes" in a source file,
    transferring only the data ranges which are actually present.
  * Added support for applications to request that session,
    connection, or TUN/TAP requests arriving on an
    SSHServerConnection be forwarded out some other established
    SSHClientConnection. Callback methods on SSHServer which
    decide how to handle these requests can now return an
    SSHClientConnection to set up this tunneling, instead of
    having to accept the request and implement their own
    forwarding logic.
  * Further hardened the SSH key exchange process to make
    AsyncSSH more strict when accepting messages during key
    exchange. Thanks go to Fabian Bäumer and Marcus Brinkmann for
    identifying potential issues here.
  * Added support for the auth_completed callback in SSHServer to
    be either a callable or a coroutine, allowing async
    operations to be performed when user authentication completes
    successfully, prior to accepting session requests.
  * Added support for the sftp_factory config argument be either
    a callable or a coroutine, allowing async operations to be
    performed when starting up a new SFTP server session.
  * Fixed a bug where the exit() method of SFTPServer didn't
    handle being declared as a coroutine. Thanks go to C. R.
    Oldham for reporting this issue.
  * Improved handling of exceptions in connection_lost()
    callbacks. Exceptions in connection_lost() will now be
    reported in the debug log, but other cleanup code in AsyncSSH
    will continue, ignoring those exceptions. Thanks go to Danil
    Slinchuk for reporting this issue.
  * Added support for specifying an explicit path when
    configuring agent forwarding. Thanks go to Aleksandr Ilin for
    pointing out that this options supports more than just a
    boolean value.
  * Added support for environment variable expansion in SSH
    config, for options which support percent expansion.
  * Added a new begin_auth callback in SSHClient, reporting the
    username being sent during SSH client authentication. This
    can be useful when the user is conditionally set via an SSH
    config file.
  * Improved strict-kex interoperability during re-keying. Thanks
    go to GitHub user emeryalden for reporting this issue and
    helping to track down the source of the problem.
  * Updated SFTP max_requests default to reduce memory usage when
    using large block sizes.
  * Updated testing to add Python 3.13 and drop Python 3.7,
    avoiding deprecation warnings from the cryptography package.
  * Fixed unit test issues under Windows, allowing unit tests to
    run on Windows on all supported versions of Python.
  * Fixed a couple of issues with Python 3.14. Thanks go to Georg
    Sauthoff for initially reporting this.
  * Added support for WebAuthN authentication with U2F security
    keys, allowing non-admin Windows users to use these keys for
    authentication. Previously, authentication with U2F keys
    worked on Windows, but only for admin users.
  * Added support for hostname canonicalization, compatible with
    the configuration parameters used in OpenSSH, as well as
    support for the "canonical" and "final" match keywords and
    negation support for match. Thanks go to GitHub user
    commonism who suggested this and provided a proposed
    implementation for negation.
  * Added client and server support for SFTP copy-data extension
    and a new SFTP remote_copy() function which allows data to be
    moved between two remote files without downloading and re-
    uploading the data. Thanks go to Ali Khosravi for suggesting
    this addition.
  * Moved project metadata from setup.py to pyproject.toml.
    Thanks go to Marc Mueller for contributing this.
  * Updated SSH connection to keep strong references to
    outstanding tasks, to avoid potential issues with the garbage
    collector while the connection is active. Thanks go to GitHub
    user Birnendampf for pointing out this potential issue and
    suggesting a simple fix.
  * Fixed some issues with block_size argument in SFTP copy
    functions. Thanks go to Krzysztof Kotlenga for finding and
    reporting these issues.
  * Fixed an import error when fido2 package wasn't available.
    Thanks go to GitHub user commonism for reporting this issue.</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1760011200">- Update to 2.21.1
  * Added the capability to defer invoking passphrase callback until
    an encrypted private key is actually used in a signing operation,
    rather than triggering the callback when keys are loaded. This
    will only work when a public key is provided with an encrypted
    private key either explicitly or as part of the key format (such
    as in OpenSSH's private key format).
  * Improved handling of KeyboardInterrupt and task cancellation in
    SCP. Thanks go to Viktor Kertesz for reporting this issue and
    helping to understand the behavior in various versions of Python.
  * Fixed the env option to support mappings other than dict. Thanks
    go to Boris Pavlovic for reporting this issue.
  * Fixed a potential race condition in SSHForwarder cleanup. Thanks
    go to GitHub user misa-hase for reporting this issue and helping
    to test the fix.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1760097600">- Add fido2-compat.patch to restore compatibility with python-fido2 &gt;= 2
- Update requirements from pyproject.toml</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1775217600">- update to 2.22.0:
  * Added a new config option utf8_decode_errors for handling
    UTF-8 decode errors when parsing certain fields in SSH
    packets (disconnect error, debug message, userauth banner,
    channel open failure reason, channel exit signal reason, and
    SFTP error reason). The default continues to behave as
    before, raising a ProtocolError exception, but this option
    allows invalid bytes to be removed or replaced. Thanks go to
    GitHub user Le-Syl21 for suggesting this.
  * Changed config parser to Ignore subdirectories and parse only
    plain files matching a glob pattern in include directives,
    better matching the behavior of other SSH implementations.
    Thanks go to Jacopo Nespolo for contributing this change.
  * Improved a previous fix for a race condition which sometimes
    triggered assertion errors in SSHForwarder. Thanks go to Mike
    Barry for reporting the issue and helping to test the
    improved fix.
  * Removed optional dependency on libnacl/libsodium for chacha20
    and Edwrds curves, now that these are available in all
    supported versions of the cryptography package.
  * Updated asyncssh to use version 2 of the fido2 package, and
    update minimum Python version to 3.10, required by that
    updated package.
  * Fixed issue with the OpenSSL legacy provider on Windows and
    re-enabled OpenSSL use in unit tests on Windows.
  * Inproved "run multiple clients" example to show the hostname
    being accessed by each task.
  * Added unit testing for Python 3.14 and dropped 3.8 and 3.9.
- drop fido2-compat.patch (upstream)</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1781611200">- Update to 2.23.1
  * Fixed an SCP path traversal issue.
  * Expanded previous fix to block unsafe user substitutions in server config.
  * Fixed default value for reuse_address and reuse_port, matching the
    behavior of asyncio.create_server().
- Update to 2.23.0 (fixes CVE-2026-45309, bsc#1268333)
  * Added support for "Match localnetwork".
  * Enabled support for RSA with SHA-2 signatures in ssh-agent and Pageant.
  * Changed MAC algorithm negotation to be skipped when using AEAD ciphers.
  * Improved graceful termination when using ProxyCommand, waiting for the
    ProxyCommand tunnel to close when cleaning up a connection.
  * Blocked unsafe user substitutions from being used in server config.
  * Fixed an issue with config evaluation when "Match final" was combined
    with Hostname directives.
  * Fixed a resource leak in xauth support.
  * Fixed issue with multi-hop ProxyJump directives in a config file not
    working correctly.
  * Fixed string encoding in SFTPName objects returned by realpath().</changelog>
</package>
<package pkgid="e75cae3d0261c17fea7b2480408472bb96aaa5245d778ba1285fbf38f59d0d621c8055716574b806346306fd67e3054e585ab6fc0195c4bb3cd4c8bb1ef31888" name="python-cffi" arch="src">
  <version epoch="0" ver="2.0.0" rel="117.10"/>
  <changelog author="Dirk Mueller &lt;dmueller@suse.com&gt;" date="1597060800">- update to 1.14.1:
  * CFFI source code is now hosted on Heptapod.
  * Improved support for typedef int my_array_t[...]; with an explicit dot-dot-dot in API mode (issue #453)
  * Windows (32 and 64 bits): multiple fixes for ABI-mode call to functions that return a structure.
  * Experimental support for MacOS 11 on aarch64.
  * and a few other minor changes and bug fixes.</changelog>
  <changelog author="Ond&#x159;ej S&#xFA;kup &lt;mimi.vx@gmail.com&gt;" date="1597924800">- update to 1.14.2
  * CPython 3 on Windows: we again try to compile with Py_LIMITED_API by default</changelog>
  <changelog author="Dirk Mueller &lt;dmueller@suse.com&gt;" date="1601294400">- update to 1.14.3:
  * no upstream changelog provided</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1608379200">- update to 1.14.4:
  * no upstream changelog provided</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1613131200">- update to 1.14.5:
  * Source fix for old gcc versions</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1626436800">- update to 1.14.6:
  * Revert "grovel: detect :float and :double in the :auto type"</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1636200000">- update to 1.15.0:
  * Fixed MANIFEST.in to include missing file for Windows arm64 support
  * Fixed Linux wheel build to use gcc default ISA for libffi
  * Updated setup.py Python trove specifiers to currently-tested Python versions
  * CPython 3.10 support (including wheels)
  * MacOS arm64 support (including wheels)
  * Initial Windows arm64 support
  * Misc. doc and test updates</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1658232000">- update to 1.15.1:
  * If you call ffi.embedding_api() but don’t write any extern “Python” function
    there, then the resulting C code would fail an assert. Fixed.
  * Updated Windows/arm64 embedded libffi static lib to v3.4.2, and scripted to
    ease future updates (thanks Niyas Sait!)</changelog>
  <changelog author="Daniel Garcia &lt;daniel.garcia@suse.com&gt;" date="1670241600">- Add python-py as test dependency</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1673006400">- add 8a3c2c816d789639b49d3ae867213393ed7abdff.patch to resolve
  testsuite failures with Python 3.11</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1681387200">- Make calling of %{sle15modernpython} optional.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1682078400">- add sle15_python_module_pythons (jsc#PED-68)</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1696593600">- Clean up the SPEC file</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1696593601">- Upgrade to 1.16.0:
  - Add support for Python 3.12. With the removal of distutils
    from Python 3.12, projects using CFFI features that depend on
    distutils at runtime must add a dependency on setuptools to
    function under Python 3.12+. CFFI does not declare a runtime
    setuptools requirement to avoid an unnecessary dependency for
    projects that do not require it.
  - Drop support for end-of-life Python versions (2.7, 3.6, 3.7).
  - Move project source under src/; a more standard layout that
    also enables CI to more easily catch packaging errors.
  - Move project home to python-cffi/cffi on GitHub.
  - Add support for PEP517 builds; setuptools is now a required
    build dependency.
  - Declare python_requires metadata for Python 3.8+. This allows
    unsupported Pythons to continue using previously released
    sdists and wheels.
  - Add missing calls to PyObject_GC_UnTrack to avoid
    ResourceWarning 15c4b71
- Remove upstreamed patch
  8a3c2c816d789639b49d3ae867213393ed7abdff.patch</changelog>
  <changelog author="Dan &#x10C;erm&#xE1;k &lt;dcermak@suse.com&gt;" date="1709208000">- drop unnecessary buildrequire python-py</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1719748800">- add py313-compat.patch
  py313-use-format-unraisable.patch
  py313-use-hashpointer.patch: add upstream patches for py3.13
  support</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1725105600">- update to 1.17.0:
  * Add support for Python 3.13.
  * In API mode, when you get a function from a C library by writing
    `fn = lib.myfunc`, you get an object of a special type for
    performance reasons, instead of a `&lt;cdata 'C-function-type'&gt;`.
    Before version 1.17 you could only call such objects.
    You could write `ffi.addressof(lib, "myfunc")` in order to get
    a real `&lt;cdata&gt;` object, based on the idea that in these cases
    in C you'd usually write `&amp;myfunc` instead of `myfunc`.  In
    version 1.17, the special object `lib.myfunc` can now be passed
    in many places where CFFI expects
    a regular `&lt;cdata&gt;` object.  For example, you can now pass
    it as a callback to a C function call, or write it inside a C
    structure field of the correct pointer-to-function type, or use
    `ffi.cast()` or `ffi.typeof()` on it.
- drop py313-compat.patch, py313-use-format-unraisable.patch,
  py313-use-hashpointer.patch (upstream)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1728475200">- update to 1.17.1:
  * Fix failing distutils.msvc9compiler imports under Windows (#118).
  * ffibuilder.emit_python_code() and ffibuiler.emit_c_code()
    accept file-like objects (#115).
  * ffiplatform calls are bypassed by ffibuilder.emit_python_code()
    and ffibuilder.emit_c_code() (#81).</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1757851200">- update to 2.0.0:
  * Added support for free threaded CPython (3.14t+ only)
  * Added support for Python 3.14.
  * Dropped support for Python 3.8.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1773662400">- Add patch support-pycparser-3.patch:
  * Support pycparser 3 exception message changes.</changelog>
</package>
<package pkgid="4483b835cbd777b821888cc0386dcf9bc881fe100d570b0c71f802f15e887a4d1eeff7063f97b674b9a51a46d4a4695e5f5718270544c1596a4c9da7369bb264" name="python-cffi-debuginfo" arch="aarch64">
  <version epoch="0" ver="2.0.0" rel="117.10"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1673006400">- add 8a3c2c816d789639b49d3ae867213393ed7abdff.patch to resolve
  testsuite failures with Python 3.11</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1681387200">- Make calling of %{sle15modernpython} optional.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1682078400">- add sle15_python_module_pythons (jsc#PED-68)</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1696593600">- Clean up the SPEC file</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1696593601">- Upgrade to 1.16.0:
  - Add support for Python 3.12. With the removal of distutils
    from Python 3.12, projects using CFFI features that depend on
    distutils at runtime must add a dependency on setuptools to
    function under Python 3.12+. CFFI does not declare a runtime
    setuptools requirement to avoid an unnecessary dependency for
    projects that do not require it.
  - Drop support for end-of-life Python versions (2.7, 3.6, 3.7).
  - Move project source under src/; a more standard layout that
    also enables CI to more easily catch packaging errors.
  - Move project home to python-cffi/cffi on GitHub.
  - Add support for PEP517 builds; setuptools is now a required
    build dependency.
  - Declare python_requires metadata for Python 3.8+. This allows
    unsupported Pythons to continue using previously released
    sdists and wheels.
  - Add missing calls to PyObject_GC_UnTrack to avoid
    ResourceWarning 15c4b71
- Remove upstreamed patch
  8a3c2c816d789639b49d3ae867213393ed7abdff.patch</changelog>
  <changelog author="Dan &#x10C;erm&#xE1;k &lt;dcermak@suse.com&gt;" date="1709208000">- drop unnecessary buildrequire python-py</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1719748800">- add py313-compat.patch
  py313-use-format-unraisable.patch
  py313-use-hashpointer.patch: add upstream patches for py3.13
  support</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1725105600">- update to 1.17.0:
  * Add support for Python 3.13.
  * In API mode, when you get a function from a C library by writing
    `fn = lib.myfunc`, you get an object of a special type for
    performance reasons, instead of a `&lt;cdata 'C-function-type'&gt;`.
    Before version 1.17 you could only call such objects.
    You could write `ffi.addressof(lib, "myfunc")` in order to get
    a real `&lt;cdata&gt;` object, based on the idea that in these cases
    in C you'd usually write `&amp;myfunc` instead of `myfunc`.  In
    version 1.17, the special object `lib.myfunc` can now be passed
    in many places where CFFI expects
    a regular `&lt;cdata&gt;` object.  For example, you can now pass
    it as a callback to a C function call, or write it inside a C
    structure field of the correct pointer-to-function type, or use
    `ffi.cast()` or `ffi.typeof()` on it.
- drop py313-compat.patch, py313-use-format-unraisable.patch,
  py313-use-hashpointer.patch (upstream)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1728475200">- update to 1.17.1:
  * Fix failing distutils.msvc9compiler imports under Windows (#118).
  * ffibuilder.emit_python_code() and ffibuiler.emit_c_code()
    accept file-like objects (#115).
  * ffiplatform calls are bypassed by ffibuilder.emit_python_code()
    and ffibuilder.emit_c_code() (#81).</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1757851200">- update to 2.0.0:
  * Added support for free threaded CPython (3.14t+ only)
  * Added support for Python 3.14.
  * Dropped support for Python 3.8.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1773662400">- Add patch support-pycparser-3.patch:
  * Support pycparser 3 exception message changes.</changelog>
</package>
<package pkgid="eb192dcb66f007296871ed5776fedd3936df2c79d880b2f81cb23eb13cfb5259cfef87b5ad74eda864ecc737bea6a684b985fd7ddbb5bbd3c42575772f45f40a" name="python-cffi-debuginfo" arch="armv7hl">
  <version epoch="0" ver="2.0.0" rel="117.10"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1673006400">- add 8a3c2c816d789639b49d3ae867213393ed7abdff.patch to resolve
  testsuite failures with Python 3.11</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1681387200">- Make calling of %{sle15modernpython} optional.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1682078400">- add sle15_python_module_pythons (jsc#PED-68)</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1696593600">- Clean up the SPEC file</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1696593601">- Upgrade to 1.16.0:
  - Add support for Python 3.12. With the removal of distutils
    from Python 3.12, projects using CFFI features that depend on
    distutils at runtime must add a dependency on setuptools to
    function under Python 3.12+. CFFI does not declare a runtime
    setuptools requirement to avoid an unnecessary dependency for
    projects that do not require it.
  - Drop support for end-of-life Python versions (2.7, 3.6, 3.7).
  - Move project source under src/; a more standard layout that
    also enables CI to more easily catch packaging errors.
  - Move project home to python-cffi/cffi on GitHub.
  - Add support for PEP517 builds; setuptools is now a required
    build dependency.
  - Declare python_requires metadata for Python 3.8+. This allows
    unsupported Pythons to continue using previously released
    sdists and wheels.
  - Add missing calls to PyObject_GC_UnTrack to avoid
    ResourceWarning 15c4b71
- Remove upstreamed patch
  8a3c2c816d789639b49d3ae867213393ed7abdff.patch</changelog>
  <changelog author="Dan &#x10C;erm&#xE1;k &lt;dcermak@suse.com&gt;" date="1709208000">- drop unnecessary buildrequire python-py</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1719748800">- add py313-compat.patch
  py313-use-format-unraisable.patch
  py313-use-hashpointer.patch: add upstream patches for py3.13
  support</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1725105600">- update to 1.17.0:
  * Add support for Python 3.13.
  * In API mode, when you get a function from a C library by writing
    `fn = lib.myfunc`, you get an object of a special type for
    performance reasons, instead of a `&lt;cdata 'C-function-type'&gt;`.
    Before version 1.17 you could only call such objects.
    You could write `ffi.addressof(lib, "myfunc")` in order to get
    a real `&lt;cdata&gt;` object, based on the idea that in these cases
    in C you'd usually write `&amp;myfunc` instead of `myfunc`.  In
    version 1.17, the special object `lib.myfunc` can now be passed
    in many places where CFFI expects
    a regular `&lt;cdata&gt;` object.  For example, you can now pass
    it as a callback to a C function call, or write it inside a C
    structure field of the correct pointer-to-function type, or use
    `ffi.cast()` or `ffi.typeof()` on it.
- drop py313-compat.patch, py313-use-format-unraisable.patch,
  py313-use-hashpointer.patch (upstream)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1728475200">- update to 1.17.1:
  * Fix failing distutils.msvc9compiler imports under Windows (#118).
  * ffibuilder.emit_python_code() and ffibuiler.emit_c_code()
    accept file-like objects (#115).
  * ffiplatform calls are bypassed by ffibuilder.emit_python_code()
    and ffibuilder.emit_c_code() (#81).</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1757851200">- update to 2.0.0:
  * Added support for free threaded CPython (3.14t+ only)
  * Added support for Python 3.14.
  * Dropped support for Python 3.8.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1773662400">- Add patch support-pycparser-3.patch:
  * Support pycparser 3 exception message changes.</changelog>
</package>
<package pkgid="10e2118d0f1b4773e5718751220a5540b7b49593d42ed0436bb9d8957515c97b2d20aac53f8667f57f4bc2c127581a6f55c5228e3a5e5c4079f70637e219fa4a" name="python-cffi-debuginfo" arch="x86_64">
  <version epoch="0" ver="2.0.0" rel="117.10"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1673006400">- add 8a3c2c816d789639b49d3ae867213393ed7abdff.patch to resolve
  testsuite failures with Python 3.11</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1681387200">- Make calling of %{sle15modernpython} optional.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1682078400">- add sle15_python_module_pythons (jsc#PED-68)</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1696593600">- Clean up the SPEC file</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1696593601">- Upgrade to 1.16.0:
  - Add support for Python 3.12. With the removal of distutils
    from Python 3.12, projects using CFFI features that depend on
    distutils at runtime must add a dependency on setuptools to
    function under Python 3.12+. CFFI does not declare a runtime
    setuptools requirement to avoid an unnecessary dependency for
    projects that do not require it.
  - Drop support for end-of-life Python versions (2.7, 3.6, 3.7).
  - Move project source under src/; a more standard layout that
    also enables CI to more easily catch packaging errors.
  - Move project home to python-cffi/cffi on GitHub.
  - Add support for PEP517 builds; setuptools is now a required
    build dependency.
  - Declare python_requires metadata for Python 3.8+. This allows
    unsupported Pythons to continue using previously released
    sdists and wheels.
  - Add missing calls to PyObject_GC_UnTrack to avoid
    ResourceWarning 15c4b71
- Remove upstreamed patch
  8a3c2c816d789639b49d3ae867213393ed7abdff.patch</changelog>
  <changelog author="Dan &#x10C;erm&#xE1;k &lt;dcermak@suse.com&gt;" date="1709208000">- drop unnecessary buildrequire python-py</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1719748800">- add py313-compat.patch
  py313-use-format-unraisable.patch
  py313-use-hashpointer.patch: add upstream patches for py3.13
  support</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1725105600">- update to 1.17.0:
  * Add support for Python 3.13.
  * In API mode, when you get a function from a C library by writing
    `fn = lib.myfunc`, you get an object of a special type for
    performance reasons, instead of a `&lt;cdata 'C-function-type'&gt;`.
    Before version 1.17 you could only call such objects.
    You could write `ffi.addressof(lib, "myfunc")` in order to get
    a real `&lt;cdata&gt;` object, based on the idea that in these cases
    in C you'd usually write `&amp;myfunc` instead of `myfunc`.  In
    version 1.17, the special object `lib.myfunc` can now be passed
    in many places where CFFI expects
    a regular `&lt;cdata&gt;` object.  For example, you can now pass
    it as a callback to a C function call, or write it inside a C
    structure field of the correct pointer-to-function type, or use
    `ffi.cast()` or `ffi.typeof()` on it.
- drop py313-compat.patch, py313-use-format-unraisable.patch,
  py313-use-hashpointer.patch (upstream)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1728475200">- update to 1.17.1:
  * Fix failing distutils.msvc9compiler imports under Windows (#118).
  * ffibuilder.emit_python_code() and ffibuiler.emit_c_code()
    accept file-like objects (#115).
  * ffiplatform calls are bypassed by ffibuilder.emit_python_code()
    and ffibuilder.emit_c_code() (#81).</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1757851200">- update to 2.0.0:
  * Added support for free threaded CPython (3.14t+ only)
  * Added support for Python 3.14.
  * Dropped support for Python 3.8.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1773662400">- Add patch support-pycparser-3.patch:
  * Support pycparser 3 exception message changes.</changelog>
</package>
<package pkgid="0be344532f8fac7622eaa6e189fa2acd9d87de687a3279c9475321ff241fc920e44b45f834c839dbc84387809594c8d583c3ea0f1dc59f67d4fd5407c33cc371" name="python-cffi-debugsource" arch="aarch64">
  <version epoch="0" ver="2.0.0" rel="117.10"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1673006400">- add 8a3c2c816d789639b49d3ae867213393ed7abdff.patch to resolve
  testsuite failures with Python 3.11</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1681387200">- Make calling of %{sle15modernpython} optional.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1682078400">- add sle15_python_module_pythons (jsc#PED-68)</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1696593600">- Clean up the SPEC file</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1696593601">- Upgrade to 1.16.0:
  - Add support for Python 3.12. With the removal of distutils
    from Python 3.12, projects using CFFI features that depend on
    distutils at runtime must add a dependency on setuptools to
    function under Python 3.12+. CFFI does not declare a runtime
    setuptools requirement to avoid an unnecessary dependency for
    projects that do not require it.
  - Drop support for end-of-life Python versions (2.7, 3.6, 3.7).
  - Move project source under src/; a more standard layout that
    also enables CI to more easily catch packaging errors.
  - Move project home to python-cffi/cffi on GitHub.
  - Add support for PEP517 builds; setuptools is now a required
    build dependency.
  - Declare python_requires metadata for Python 3.8+. This allows
    unsupported Pythons to continue using previously released
    sdists and wheels.
  - Add missing calls to PyObject_GC_UnTrack to avoid
    ResourceWarning 15c4b71
- Remove upstreamed patch
  8a3c2c816d789639b49d3ae867213393ed7abdff.patch</changelog>
  <changelog author="Dan &#x10C;erm&#xE1;k &lt;dcermak@suse.com&gt;" date="1709208000">- drop unnecessary buildrequire python-py</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1719748800">- add py313-compat.patch
  py313-use-format-unraisable.patch
  py313-use-hashpointer.patch: add upstream patches for py3.13
  support</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1725105600">- update to 1.17.0:
  * Add support for Python 3.13.
  * In API mode, when you get a function from a C library by writing
    `fn = lib.myfunc`, you get an object of a special type for
    performance reasons, instead of a `&lt;cdata 'C-function-type'&gt;`.
    Before version 1.17 you could only call such objects.
    You could write `ffi.addressof(lib, "myfunc")` in order to get
    a real `&lt;cdata&gt;` object, based on the idea that in these cases
    in C you'd usually write `&amp;myfunc` instead of `myfunc`.  In
    version 1.17, the special object `lib.myfunc` can now be passed
    in many places where CFFI expects
    a regular `&lt;cdata&gt;` object.  For example, you can now pass
    it as a callback to a C function call, or write it inside a C
    structure field of the correct pointer-to-function type, or use
    `ffi.cast()` or `ffi.typeof()` on it.
- drop py313-compat.patch, py313-use-format-unraisable.patch,
  py313-use-hashpointer.patch (upstream)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1728475200">- update to 1.17.1:
  * Fix failing distutils.msvc9compiler imports under Windows (#118).
  * ffibuilder.emit_python_code() and ffibuiler.emit_c_code()
    accept file-like objects (#115).
  * ffiplatform calls are bypassed by ffibuilder.emit_python_code()
    and ffibuilder.emit_c_code() (#81).</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1757851200">- update to 2.0.0:
  * Added support for free threaded CPython (3.14t+ only)
  * Added support for Python 3.14.
  * Dropped support for Python 3.8.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1773662400">- Add patch support-pycparser-3.patch:
  * Support pycparser 3 exception message changes.</changelog>
</package>
<package pkgid="efe979c8567650a84f763efc8bd07b579b6db0face71c6e382d3fb746ef12a35335d81da7d49d623ad6cf3f5951856d3a07fe63a8a85d83f07f03e6f1c98fb29" name="python-cffi-debugsource" arch="armv7hl">
  <version epoch="0" ver="2.0.0" rel="117.10"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1673006400">- add 8a3c2c816d789639b49d3ae867213393ed7abdff.patch to resolve
  testsuite failures with Python 3.11</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1681387200">- Make calling of %{sle15modernpython} optional.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1682078400">- add sle15_python_module_pythons (jsc#PED-68)</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1696593600">- Clean up the SPEC file</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1696593601">- Upgrade to 1.16.0:
  - Add support for Python 3.12. With the removal of distutils
    from Python 3.12, projects using CFFI features that depend on
    distutils at runtime must add a dependency on setuptools to
    function under Python 3.12+. CFFI does not declare a runtime
    setuptools requirement to avoid an unnecessary dependency for
    projects that do not require it.
  - Drop support for end-of-life Python versions (2.7, 3.6, 3.7).
  - Move project source under src/; a more standard layout that
    also enables CI to more easily catch packaging errors.
  - Move project home to python-cffi/cffi on GitHub.
  - Add support for PEP517 builds; setuptools is now a required
    build dependency.
  - Declare python_requires metadata for Python 3.8+. This allows
    unsupported Pythons to continue using previously released
    sdists and wheels.
  - Add missing calls to PyObject_GC_UnTrack to avoid
    ResourceWarning 15c4b71
- Remove upstreamed patch
  8a3c2c816d789639b49d3ae867213393ed7abdff.patch</changelog>
  <changelog author="Dan &#x10C;erm&#xE1;k &lt;dcermak@suse.com&gt;" date="1709208000">- drop unnecessary buildrequire python-py</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1719748800">- add py313-compat.patch
  py313-use-format-unraisable.patch
  py313-use-hashpointer.patch: add upstream patches for py3.13
  support</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1725105600">- update to 1.17.0:
  * Add support for Python 3.13.
  * In API mode, when you get a function from a C library by writing
    `fn = lib.myfunc`, you get an object of a special type for
    performance reasons, instead of a `&lt;cdata 'C-function-type'&gt;`.
    Before version 1.17 you could only call such objects.
    You could write `ffi.addressof(lib, "myfunc")` in order to get
    a real `&lt;cdata&gt;` object, based on the idea that in these cases
    in C you'd usually write `&amp;myfunc` instead of `myfunc`.  In
    version 1.17, the special object `lib.myfunc` can now be passed
    in many places where CFFI expects
    a regular `&lt;cdata&gt;` object.  For example, you can now pass
    it as a callback to a C function call, or write it inside a C
    structure field of the correct pointer-to-function type, or use
    `ffi.cast()` or `ffi.typeof()` on it.
- drop py313-compat.patch, py313-use-format-unraisable.patch,
  py313-use-hashpointer.patch (upstream)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1728475200">- update to 1.17.1:
  * Fix failing distutils.msvc9compiler imports under Windows (#118).
  * ffibuilder.emit_python_code() and ffibuiler.emit_c_code()
    accept file-like objects (#115).
  * ffiplatform calls are bypassed by ffibuilder.emit_python_code()
    and ffibuilder.emit_c_code() (#81).</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1757851200">- update to 2.0.0:
  * Added support for free threaded CPython (3.14t+ only)
  * Added support for Python 3.14.
  * Dropped support for Python 3.8.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1773662400">- Add patch support-pycparser-3.patch:
  * Support pycparser 3 exception message changes.</changelog>
</package>
<package pkgid="0f02f87b5b57182287a1e51ad5377c36f1178370bf9ff9ea2095f143fca77c8fd92336c8d512e8384808dbd0710d80f5f1791523be305220b918c1130c9f2a75" name="python-cffi-debugsource" arch="x86_64">
  <version epoch="0" ver="2.0.0" rel="117.10"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1673006400">- add 8a3c2c816d789639b49d3ae867213393ed7abdff.patch to resolve
  testsuite failures with Python 3.11</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1681387200">- Make calling of %{sle15modernpython} optional.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1682078400">- add sle15_python_module_pythons (jsc#PED-68)</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1696593600">- Clean up the SPEC file</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1696593601">- Upgrade to 1.16.0:
  - Add support for Python 3.12. With the removal of distutils
    from Python 3.12, projects using CFFI features that depend on
    distutils at runtime must add a dependency on setuptools to
    function under Python 3.12+. CFFI does not declare a runtime
    setuptools requirement to avoid an unnecessary dependency for
    projects that do not require it.
  - Drop support for end-of-life Python versions (2.7, 3.6, 3.7).
  - Move project source under src/; a more standard layout that
    also enables CI to more easily catch packaging errors.
  - Move project home to python-cffi/cffi on GitHub.
  - Add support for PEP517 builds; setuptools is now a required
    build dependency.
  - Declare python_requires metadata for Python 3.8+. This allows
    unsupported Pythons to continue using previously released
    sdists and wheels.
  - Add missing calls to PyObject_GC_UnTrack to avoid
    ResourceWarning 15c4b71
- Remove upstreamed patch
  8a3c2c816d789639b49d3ae867213393ed7abdff.patch</changelog>
  <changelog author="Dan &#x10C;erm&#xE1;k &lt;dcermak@suse.com&gt;" date="1709208000">- drop unnecessary buildrequire python-py</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1719748800">- add py313-compat.patch
  py313-use-format-unraisable.patch
  py313-use-hashpointer.patch: add upstream patches for py3.13
  support</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1725105600">- update to 1.17.0:
  * Add support for Python 3.13.
  * In API mode, when you get a function from a C library by writing
    `fn = lib.myfunc`, you get an object of a special type for
    performance reasons, instead of a `&lt;cdata 'C-function-type'&gt;`.
    Before version 1.17 you could only call such objects.
    You could write `ffi.addressof(lib, "myfunc")` in order to get
    a real `&lt;cdata&gt;` object, based on the idea that in these cases
    in C you'd usually write `&amp;myfunc` instead of `myfunc`.  In
    version 1.17, the special object `lib.myfunc` can now be passed
    in many places where CFFI expects
    a regular `&lt;cdata&gt;` object.  For example, you can now pass
    it as a callback to a C function call, or write it inside a C
    structure field of the correct pointer-to-function type, or use
    `ffi.cast()` or `ffi.typeof()` on it.
- drop py313-compat.patch, py313-use-format-unraisable.patch,
  py313-use-hashpointer.patch (upstream)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1728475200">- update to 1.17.1:
  * Fix failing distutils.msvc9compiler imports under Windows (#118).
  * ffibuilder.emit_python_code() and ffibuiler.emit_c_code()
    accept file-like objects (#115).
  * ffiplatform calls are bypassed by ffibuilder.emit_python_code()
    and ffibuilder.emit_c_code() (#81).</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1757851200">- update to 2.0.0:
  * Added support for free threaded CPython (3.14t+ only)
  * Added support for Python 3.14.
  * Dropped support for Python 3.8.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1773662400">- Add patch support-pycparser-3.patch:
  * Support pycparser 3 exception message changes.</changelog>
</package>
<package pkgid="424a45431edd4f5376dab27568144c9139ad6139874c9b63472ce3fcfe0efa54f7735d5ebaa4d6a67acfcfa4ca6ccc5df58442e77bb1a34e9cd5882a18aa17cf" name="python-cryptography" arch="src">
  <version epoch="0" ver="49.0.0" rel="289.3"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1727524800">- update to 43.0.1:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.3.2.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1729598400">- update to 43.0.3:
  * Fixed release metadata for cryptography-vectors
  * Fixed compilation when using LibreSSL 4.0.0.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1730808000">- Avoid using requires_eq, which after the last modifications
  conflicts with python singlespec (order of expansion).</changelog>
  <changelog author="Ben Greiner &lt;code@bnavigator.de&gt;" date="1731067200">- Fix requires_eq replacement for distributions which do not have
  python3-cffi installed (such as SLE15 python module pythons)
  * gh#openSUSE/python-rpm-macros#185
- Remove outdated section in description</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfyhalomacro@opensuse.org&gt;" date="1737892800">- Update to version 44.0.0:
  * BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL &lt; 3.9.
  * Deprecated Python 3.7 support. Python 3.7 is no longer supported by
    the Python core team. Support for Python 3.7 will be removed in a future
    cryptography release.
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.4.0.
  * macOS wheels are now built against the macOS 10.13 SDK. Users on older
    versions of macOS should upgrade, or they will need to build cryptography
    themselves.
  * Enforce the RFC 5280 requirement that extended key usage extensions must not be empty.
  * Added support for timestamp extraction to the :class:`~cryptography.fernet.MultiFernet` class.
  * Relax the Authority Key Identifier requirements on root CA certificates
    during X.509 verification to allow fields permitted by RFC 5280 but
    forbidden by the CA/Browser BRs.
  * Added support for
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2id` when using
    OpenSSL 3.2.0+.
  * Added support for the :class:`~cryptography.x509.Admissions` certificate extension.
  * Added basic support for PKCS7 decryption (including S/MIME 3.2) via
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der`,
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_pem`,
    and :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_smime`.
- Update specfile to accommodate new project structure at version 44.0.0
- Update no-pytest_benchmark.patch</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1740571200">- update to 44.0.1:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.4.1.
  * We now build armv7l manylinux wheels and publish them to
    PyPI.
  * We now build manylinux_2_34 wheels and publish them to PyPI.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1742731200">- update to 44.0.2:
  * We now build wheels for PyPy 3.11.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1746619200">- Update to 44.0.3
  * Fixed compilation when using LibreSSL 4.1.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1752321600">- update to 45.0.5:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.1.
  * Fixed decrypting PKCS#8 files encrypted with SHA1-RC4. (This
    is not considered secure, and is supported only for backwards
    compatibility.)
  * Fixed decrypting PKCS#8 files encrypted with long salts (this
    impacts keys encrypted by Bouncy Castle).
  * Fixed decrypting PKCS#8 files encrypted with DES-CBC-MD5.
    While wildly insecure, this remains prevalent.
  * Fixed using mypy with cryptography on older versions of
    Python.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.0.
  * Support for Python 3.7 is deprecated and will be removed in
    the next cryptography release.
  * Updated the minimum supported Rust version (MSRV) to 1.74.0,
    from 1.65.0.
  * Added support for serialization of PKCS#12 Java truststores
    in :func:`~cryptography.hazmat.primitives.serialization.pkcs1
    2.serialize_java_truststore`
  * Added :meth:`~cryptography.hazmat.primitives.kdf.argon2.Argon
    2id.derive_phc_encoded` and :meth:`~cryptography.hazmat.primi
    tives.kdf.argon2.Argon2id.verify_phc_encoded` methods to
    support password hashing in the PHC string format
  * Added support for PKCS7 decryption and encryption using
    AES-256 as the content algorithm, in addition to AES-128.
  * BACKWARDS INCOMPATIBLE: Made SSH private key loading more
    consistent with other private key loading: :func:`~cryptograp
    hy.hazmat.primitives.serialization.load_ssh_private_key` now
    raises a TypeError if the key is unencrypted but a password
    is provided (previously no exception was raised), and raises
    a TypeError if the key is encrypted but no password is
    provided (previously a ValueError was raised).
  * Added __copy__ to the :class:`~cryptography.hazmat.primitives
    .asymmetric.ec.EllipticCurvePrivateKey`, :class:`~cryptograph
    y.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey`, :c
    lass:`~cryptography.hazmat.primitives.asymmetric.ed25519.Ed25
    519PublicKey`, :class:`~cryptography.hazmat.primitives.asymme
    tric.ed25519.Ed25519PrivateKey`, :class:`~cryptography.hazmat
    .primitives.asymmetric.ed448.Ed448PublicKey`, :class:`~crypto
    graphy.hazmat.primitives.asymmetric.ed448.Ed448PrivateKey`, :
    class:`~cryptography.hazmat.primitives.asymmetric.x25519.X255
    19PublicKey`, :class:`~cryptography.hazmat.primitives.asymmet
    ric.x25519.X25519PrivateKey`, :class:`~cryptography.hazmat.pr
    imitives.asymmetric.x448.X448PublicKey`, :class:`~cryptograph
    y.hazmat.primitives.asymmetric.x448.X448PrivateKey`, :class:`
    ~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey`
    , :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAP
    ublicKey`, :class:`~cryptography.hazmat.primitives.asymmetric
    .dsa.DSAPrivateKey`, :class:`~cryptography.hazmat.primitives.
    asymmetric.dsa.DSAPublicKey`, :class:`~cryptography.hazmat.pr
    imitives.asymmetric.dh.DHPrivateKey`, and :class:`~cryptograp
    hy.hazmat.primitives.asymmetric.dh.DHPublicKey` abstract base
    classes.
  * We significantly refactored how private key loading ( :func:`
    ~cryptography.hazmat.primitives.serialization.load_pem_privat
    e_key` and :func:`~cryptography.hazmat.primitives.serializati
    on.load_der_private_key`) works. This is intended to be
    backwards compatible for all well-formed keys, therefore if
    you discover a key that now raises an exception, please file
    a bug with instructions for reproducing.
  * Added unsafe_skip_rsa_key_validation keyword-argument to :fun
    c:`~cryptography.hazmat.primitives.serialization.load_ssh_pri
    vate_key`.
  * Added :class:`~cryptography.hazmat.primitives.hashes.XOFHash`
    to support repeated :meth:`~cryptography.hazmat.primitives.ha
    shes.XOFHash.squeeze` operations on extendable output
    functions.
  * Added :meth:`~cryptography.x509.ocsp.OCSPResponseBuilder.add_
    response_by_hash` method to allow creating OCSP responses
    using certificate hash values rather than full certificates.
  * Extended the :mod:`X.509 path validation
    &lt;cryptography.x509.verification&gt;` API to support user-
    configured extension policies via the
    :meth:`PolicyBuilder.extension_policies &lt;cryptography.x509.ve
    rification.PolicyBuilder.extension_policies&gt;` method.
  * Deprecated the subject, verification_time and max_chain_depth
    properties on
    :class:`~cryptography.x509.verification.ClientVerifier` and
    :class:`~cryptography.x509.verification.ServerVerifier` in
    favor of a new policy property. These properties will be
    removed in the next release of cryptography.
  * BACKWARDS INCOMPATIBLE: The :meth:`VerifiedClient.subject
    &lt;cryptography.x509.verification.VerifiedClient.subjects&gt;`
    property can now be None since a custom extension policy may
    allow certificates without a Subject Alternative Name
    extension.
  * Changed the behavior when the OpenSSL 3 legacy provider fails
    to load. Instead of raising an exception, a warning is now
    emitted. The CRYPTOGRAPHY_OPENSSL_NO_LEGACY environment
    variable can still be used to disable the legacy provider at
    runtime.
  * Added support for the CRYPTOGRAPHY_BUILD_OPENSSL_NO_LEGACY
    environment variable during build time, which prevents the
    library from ever attempting to load the legacy provider.
  * Added support for the
    :class:`~cryptography.x509.PrivateKeyUsagePeriod` X.509
    extension. This extension defines the period during which the
    private key corresponding to the certificate's public key may
    be used.
  * Added support for compiling against `aws-lc`_.
  * Parsing X.509 structures now more strictly enforces that Name
    structures do not have malformed ASN.1.
  * We now publish py311 wheels that utilize the faster
    pyo3::buffer::PyBuffer interface, resulting in significantly
    improved performance for operations involving small buffers.
  * Added :func:`~cryptography.hazmat.primitives.serialization.ss
    h_key_fingerprint` for computing fingerprints of SSH public
    keys.
  * Added support for deterministic ECDSA signing via the new
    keyword-only argument ecdsa_deterministic in
    :meth:`~cryptography.x509.CertificateBuilder.sign`, :meth:`~c
    ryptography.x509.CertificateRevocationListBuilder.sign` and :
    meth:`~cryptography.x509.CertificateSigningRequestBuilder.sig
    n`.</changelog>
  <changelog author="James Oakley &lt;jfunk@opensuse.org&gt;" date="1756728000">- Add Make-unsafe-subinterpreter-support-available-via-cfg.patch
  to allow ceph-mgr to load modules (boo#1248987)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1757851200">- update to 45.0.7:
  * Added a function to support an upcoming pyOpenSSL release.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1760356800">- update to 46.0.2:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.4.
  * Fixed an issue where users installing via pip on Python 3.14
    development versions would not properly install a dependency.
  * Fixed an issue building the free-threaded macOS 3.14 wheels.
  * BACKWARDS INCOMPATIBLE: Support for Python 3.7 has been
    removed.
  * Support for OpenSSL &lt; 3.0 is deprecated and will be removed
    in the next release.
  * Support for x86_64 macOS (including publishing wheels) is
    deprecated and will be removed in two releases. We will
    switch to publishing an arm64 only wheel for macOS.
  * Support for 32-bit Windows (including publishing wheels) is
    deprecated and will be removed in two releases. Users should
    move to a 64-bit Python installation.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.3.
  * We now build ppc64le manylinux wheels and publish them to
    PyPI.
  * We now build win_arm64 (Windows on Arm) wheels and publish
    them to PyPI.
  * Added support for free-threaded Python 3.14.
  * Removed the deprecated get_attribute_for_oid method on
    :class:`~cryptography.x509.CertificateSigningRequest`. Users
    should use
    :meth:`~cryptography.x509.Attributes.get_attribute_for_oid`
    instead.
  * Removed the deprecated CAST5, SEED, IDEA, and Blowfish
    classes from the cipher module. These are still available in
    :doc:`/hazmat/decrepit/index`.
  * In X.509, when performing a PSS signature with a SHA-3 hash,
    it is now encoded with the official NIST SHA3 OID.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1765195200">- Only require pytest-subtests with pytest &lt; 9.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1770897600">- Update to 46.0.5 (fixes CVE-2026-26007, bsc#1258074)
  * An attacker could create a malicious public key that reveals portions of
    your private key when using certain uncommon elliptic curves (binary
    curves). This version now includes additional security checks to prevent
    this attack. This issue only affects binary elliptic curves, which are
    rarely used in real-world applications. Credit to XlabAI Team of Tencent
    Xuanwu Lab and Atuin Automated Vulnerability Discovery Engine for reporting
    the issue. CVE-2026-26007
  * Support for SECT* binary elliptic curves is deprecated and will be removed
    in the next release.
- Update to 46.0.4
  * Dropped support for win_arm64 wheels.
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.5.
- Update to 46.0.3
  * Fixed compilation when using LibreSSL 4.2.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1774612800">- update to 46.0.6 (CVE-2026-34073, bsc#1260876):
  * SECURITY ISSUE: Fixed a bug where name constraints were not
    applied to peer names during verification when the leaf
    certificate contains a wildcard DNS SAN. Ordinary X.509
    topologies are not affected by this bug, including those used
    by the Web PKI. Credit to Oleh Konko (1seal) for reporting
    the issue. CVE-2026-34073</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1774958400">- Add patch support-maturin-1.12.patch:
  * Correctly deal with maturin bugfix that installs tests and
    docs under sitearch.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1775822400">- Update to 46.0.7 (fixes CVE-2026-39892, bsc#1261863)
  * **SECURITY ISSUE**: Fixed an issue where non-contiguous buffers could be
    passed to APIs that accept Python buffers, which could lead to buffer
    overflow. **CVE-2026-39892**
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.6.
- drop support-maturin-1.12.patch (upstream)
- drop no-pytest_benchmark.patch,
  Make-unsafe-subinterpreter-support-available-via-cfg.patch:
  obsolete</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1777204800">- update to 47.0.0:
  * Support for Python 3.8 is deprecated and will be removed in
    the next cryptography release.
  * BACKWARDS INCOMPATIBLE: Support for binary elliptic curves
    (SECT* classes) has been removed. These curves are rarely
    used and have additional security considerations that make
    them undesirable.
  * BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.1.x has been
    removed. OpenSSL 3.0.0 or later is now required. LibreSSL,
    BoringSSL, and AWS-LC continue to be supported.
  * BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL &lt; 4.1.
  * BACKWARDS INCOMPATIBLE: Loading keys with unsupported
    algorithms or keys with unsupported explicit curve encodings
    now raises
    :class:`~cryptography.exceptions.UnsupportedAlgorithm`
    instead of ValueError. This change affects :func:`~cryptograp
    hy.hazmat.primitives.serialization.load_pem_private_key`, :fu
    nc:`~cryptography.hazmat.primitives.serialization.load_der_pr
    ivate_key`, :func:`~cryptography.hazmat.primitives.serializat
    ion.load_pem_public_key`, :func:`~cryptography.hazmat.primiti
    ves.serialization.load_der_public_key`, and
    :meth:`~cryptography.x509.Certificate.public_key` when called
    on certificates with unsupported public key algorithms.
  * BACKWARDS INCOMPATIBLE: When parsing elliptic curve private
    keys, we now reject keys that incorrectly encode a private
    key of the wrong length because such keys are impossible to
    process in a constant-time manner. We do not believe keys
    with this problem are in wide use, however we may revert this
    change based on the feedback we receive.
  * Deprecated passing 64-bit (8-byte) and 128-bit (16-byte) keys
    to :class:`~cryptography.hazmat.decrepit.ciphers.algorithms.T
    ripleDES`. In a future release, only 192-bit (24-byte) keys
    will be accepted. Users should expand shorter keys themselves
    (e.g., for single DES: key + key + key, for two-key: key +
    key[:8]).
  * Updated the minimum supported Rust version (MSRV) to 1.83.0,
    from 1.74.0.
  * Support for x86_64 macOS (including publishing wheels) is
    deprecated and will be removed in the next release. We will
    switch to publishing an arm64 only wheel for macOS.
  * Support for 32-bit Windows (including publishing wheels) is
    deprecated and will be removed in the next release. Users
    should move to a 64-bit Python installation.
  * public_bytes and private_bytes methods on keys now raise
    TypeError (instead of ValueError) if an invalid encoding is
    provided for the given format.
  * Moved
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.CFB`,
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.OFB`, and
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.CFB8`
    into :doc:`/hazmat/decrepit/index` and deprecated them in the
    modes module. They will be removed from the modes module in
    49.0.0.
  * Moved :class:`~cryptography.hazmat.primitives.ciphers.algorit
    hms.Camellia` into  :doc:`/hazmat/decrepit/index` and
    deprecated it in the cipher module. It will be removed from
    the cipher module in 49.0.0.
  * Added
    :meth:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF.extract`
    to :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF`.
    The previous private implementation will be removed in
    49.0.0.
  * Added support for loading elliptic curve keys that contain
    explicit encodings of the curves secp256r1, secp384r1, and
    secp521r1.
  * Added support for
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2d`
    and
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2i`
    when using OpenSSL 3.2.0+.
  * Added derive_into methods to
    :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF`,
    :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDFExpand`,
    :class:`~cryptography.hazmat.primitives.kdf.concatkdf.ConcatK
    DFHash`, :class:`~cryptography.hazmat.primitives.kdf.concatkd
    f.ConcatKDFHMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2id`,
    :class:`~cryptography.hazmat.primitives.kdf.pbkdf2.PBKDF2HMAC
    `,
    :class:`~cryptography.hazmat.primitives.kdf.kbkdf.KBKDFHMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.kbkdf.KBKDFCMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.scrypt.Scrypt`,
    and
    :class:`~cryptography.hazmat.primitives.kdf.x963kdf.X963KDF`
    to allow deriving keys directly into pre-allocated buffers.
  * Added encrypt_into and decrypt_into methods to
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESCCM`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESGCM`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESGCMSI
    V`, :class:`~cryptography.hazmat.primitives.ciphers.aead.AESO
    CB3`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESSIV`,
    and :class:`~cryptography.hazmat.primitives.ciphers.aead.ChaC
    ha20Poly1305` to allow encrypting directly into a pre-
    allocated buffer.
  * Added support for PKCS1v15 signing without DigestInfo using :
    class:`~cryptography.hazmat.primitives.asymmetric.utils.NoDig
    estInfo`.
  * Added
    :meth:`~cryptography.hazmat.primitives.hashes.Hash.hash`, a
    one-shot method for computing hashes.
  * Added :doc:`/hazmat/primitives/hpke` support implementing RFC
    9180 for hybrid authenticated encryption.
  * Added new :doc:`/hazmat/primitives/asymmetric/mlkem` module
    with support for ML-KEM key encapsulation with AWS-LC and
    BoringSSL. Note: Post-quantum algorithm support requires AWS-
    LC or BoringSSL. As we ship our wheels with OpenSSL, most
    users will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Note: Post-quantum algorithm support requires AWS-LC or
    BoringSSL. As we ship our wheels with OpenSSL, most users
    will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Added new :doc:`/hazmat/primitives/asymmetric/mldsa` module
    with support for ML-DSA signing and verification with AWS-LC
    and BoringSSL. Note: Post-quantum algorithm support requires
    AWS-LC or BoringSSL. As we ship our wheels with OpenSSL, most
    users will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Note: Post-quantum algorithm support requires AWS-LC or
    BoringSSL. As we ship our wheels with OpenSSL, most users
    will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Added new :doc:`/hazmat/asn1/index` module with support for
    declaratively defining custom ASN.1 types and
    encoding/decoding them.
  * Fixed compilation when using LibreSSL 4.3.0 and OpenSSL
    4.0.0.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 4.0.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1778414400">- update to 48.0.0:
  * BACKWARDS INCOMPATIBLE: Support for Python 3.8 has been
    removed. cryptography now requires Python 3.9 or later.
  * BACKWARDS INCOMPATIBLE: Loading an X.509 CRL whose inner
    TBSCertList.signature algorithm does not match the outer
    signatureAlgorithm now raises ValueError. Previously, such
    CRLs were parsed successfully and only rejected during
    signature validation.
  * Added support for :doc:`/hazmat/primitives/asymmetric/mlkem`
    and :doc:`/hazmat/primitives/asymmetric/mldsa` when using
    OpenSSL 3.5.0 or later, in addition to the existing AWS-LC
    and BoringSSL support. This means post-quantum algorithms are
    now available to users of our wheels. Note: Going forward, we
    do not guarantee that all functionality in cryptography will
    be available when building against OpenSSL. See
    :doc:`/statements/state-of-openssl` for more information.
  * Note: Going forward, we do not guarantee that all
    functionality in cryptography will be available when building
    against OpenSSL. See :doc:`/statements/state-of-openssl` for
    more information.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1781438400">- update to 49.0.0:
  * BACKWARDS INCOMPATIBLE: Removed the deprecated
    PUBLIC_KEY_TYPES, PRIVATE_KEY_TYPES,
    CERTIFICATE_PRIVATE_KEY_TYPES,
    CERTIFICATE_ISSUER_PUBLIC_KEY_TYPES, and
    CERTIFICATE_PUBLIC_KEY_TYPES type aliases. Use
    PublicKeyTypes, PrivateKeyTypes,
    CertificateIssuerPrivateKeyTypes,
    CertificateIssuerPublicKeyTypes, and
    CertificatePublicKeyTypes instead. These were deprecated in
    version 40.0.
  * BACKWARDS INCOMPATIBLE: :class:`~cryptography.hazmat.primitiv
    es.ciphers.algorithms.ChaCha20` now treats the first 4 bytes
    of the nonce as a 32-bit little-endian block counter (as
    defined in RFC 7539) and tracks the number of bytes
    processed. Attempting to encrypt or decrypt more data than
    the counter allows before it would overflow now raises a
    :class:`ValueError` rather than silently diverging from RFC
    7539. Setting the counter portion of the nonce to zero allows
    encrypting up to 256 GiB with a given nonce.
  * BACKWARDS INCOMPATIBLE: Loading an X.509 certificate whose
    ECDSA or DSA signature AlgorithmIdentifier contains encoded
    NULL parameters now raises a :class:`ValueError`. Such
    certificates are invalid, but older versions of Java emitted
    them; previously they loaded with a deprecation warning.
  * Fixed cross-compilation of the CFFI bindings when
    PYO3_CROSS_LIB_DIR is set. The build now derives the Python
    include directory from PYO3_CROSS_LIB_DIR instead of querying
    the host interpreter, which previously caused the build to
    fail during cross-compilations for embedded systems, on hosts
    which have same-version Python development headers installed
    as the target Python.
  * Added support for signing and verifying X.509 certificates,
    certificate signing requests, and certificate revocation
    lists with :doc:`/hazmat/primitives/asymmetric/mldsa` keys,
    as well as loading certificates that contain ML-DSA public
    keys.
  * Added
    :meth:`~cryptography.hazmat.primitives.hpke.KEM.enc_length`
    to :class:`~cryptography.hazmat.primitives.hpke.KEM` so
    callers can split the encapsulated key from the ciphertext
    returned by
    :meth:`~cryptography.hazmat.primitives.hpke.Suite.encrypt`.
  * :meth:`~cryptography.x509.verification.ExtensionPolicy.requir
    e_present`, :meth:`~cryptography.x509.verification.ExtensionP
    olicy.may_be_present`, and :meth:`~cryptography.x509.verifica
    tion.ExtensionPolicy.require_not_present` now accept any
    extension type. Previously only a fixed set of extension
    types was supported, which made it impossible to account for
    otherwise unrecognized critical extensions during path
    validation.
  * Added support for using
    :class:`~cryptography.x509.Certificate`,
    :class:`~cryptography.x509.CertificateSigningRequest`, and
    :class:`~cryptography.x509.CertificateRevocationList` as
    field types in :doc:`/hazmat/asn1/index` structures.
  * Added :func:`~cryptography.hazmat.asn1.value_set`, a class
    decorator that registers an :class:`enum.Enum` subclass as an
    ASN.1 value set: members are encoded as their underlying
    value, and decoding fails if the decoded value does not match
    one of the declared members.
  * Added :meth:`~cryptography.x509.Name.from_bytes` for parsing
    a :class:`~cryptography.x509.Name` from DER bytes, the
    inverse of :meth:`~cryptography.x509.Name.public_bytes`.
  * Added the rsa_padding keyword-only parameter to
    :meth:`~cryptography.x509.CertificateBuilder.public_key`.
    Passing the :class:`~cryptography.hazmat.primitives.asymmetri
    c.padding.PSS` class (not an instance) encodes an RSA subject
    public key in the certificate's subjectPublicKeyInfo with the
    id-RSASSA-PSS OID and no parameters.
  * Added external mu (message representative) support to
    :doc:`/hazmat/primitives/asymmetric/mldsa` via the sign_mu
    and verify_mu methods, which sign and verify a precomputed
    64-byte mu as defined in FIPS 204.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 4.0.1.</changelog>
</package>
<package pkgid="c2df756296a815bbbf11720963f80d22dba81f64a880bf6ad480ce12b0ccf8abcfee2f08390f8a4a25939f10e0f87aa8406a092c12c05c9f6ee5bb7877028055" name="python-cryptography-debuginfo" arch="aarch64">
  <version epoch="0" ver="49.0.0" rel="289.3"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1727524800">- update to 43.0.1:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.3.2.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1729598400">- update to 43.0.3:
  * Fixed release metadata for cryptography-vectors
  * Fixed compilation when using LibreSSL 4.0.0.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1730808000">- Avoid using requires_eq, which after the last modifications
  conflicts with python singlespec (order of expansion).</changelog>
  <changelog author="Ben Greiner &lt;code@bnavigator.de&gt;" date="1731067200">- Fix requires_eq replacement for distributions which do not have
  python3-cffi installed (such as SLE15 python module pythons)
  * gh#openSUSE/python-rpm-macros#185
- Remove outdated section in description</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfyhalomacro@opensuse.org&gt;" date="1737892800">- Update to version 44.0.0:
  * BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL &lt; 3.9.
  * Deprecated Python 3.7 support. Python 3.7 is no longer supported by
    the Python core team. Support for Python 3.7 will be removed in a future
    cryptography release.
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.4.0.
  * macOS wheels are now built against the macOS 10.13 SDK. Users on older
    versions of macOS should upgrade, or they will need to build cryptography
    themselves.
  * Enforce the RFC 5280 requirement that extended key usage extensions must not be empty.
  * Added support for timestamp extraction to the :class:`~cryptography.fernet.MultiFernet` class.
  * Relax the Authority Key Identifier requirements on root CA certificates
    during X.509 verification to allow fields permitted by RFC 5280 but
    forbidden by the CA/Browser BRs.
  * Added support for
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2id` when using
    OpenSSL 3.2.0+.
  * Added support for the :class:`~cryptography.x509.Admissions` certificate extension.
  * Added basic support for PKCS7 decryption (including S/MIME 3.2) via
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der`,
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_pem`,
    and :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_smime`.
- Update specfile to accommodate new project structure at version 44.0.0
- Update no-pytest_benchmark.patch</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1740571200">- update to 44.0.1:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.4.1.
  * We now build armv7l manylinux wheels and publish them to
    PyPI.
  * We now build manylinux_2_34 wheels and publish them to PyPI.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1742731200">- update to 44.0.2:
  * We now build wheels for PyPy 3.11.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1746619200">- Update to 44.0.3
  * Fixed compilation when using LibreSSL 4.1.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1752321600">- update to 45.0.5:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.1.
  * Fixed decrypting PKCS#8 files encrypted with SHA1-RC4. (This
    is not considered secure, and is supported only for backwards
    compatibility.)
  * Fixed decrypting PKCS#8 files encrypted with long salts (this
    impacts keys encrypted by Bouncy Castle).
  * Fixed decrypting PKCS#8 files encrypted with DES-CBC-MD5.
    While wildly insecure, this remains prevalent.
  * Fixed using mypy with cryptography on older versions of
    Python.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.0.
  * Support for Python 3.7 is deprecated and will be removed in
    the next cryptography release.
  * Updated the minimum supported Rust version (MSRV) to 1.74.0,
    from 1.65.0.
  * Added support for serialization of PKCS#12 Java truststores
    in :func:`~cryptography.hazmat.primitives.serialization.pkcs1
    2.serialize_java_truststore`
  * Added :meth:`~cryptography.hazmat.primitives.kdf.argon2.Argon
    2id.derive_phc_encoded` and :meth:`~cryptography.hazmat.primi
    tives.kdf.argon2.Argon2id.verify_phc_encoded` methods to
    support password hashing in the PHC string format
  * Added support for PKCS7 decryption and encryption using
    AES-256 as the content algorithm, in addition to AES-128.
  * BACKWARDS INCOMPATIBLE: Made SSH private key loading more
    consistent with other private key loading: :func:`~cryptograp
    hy.hazmat.primitives.serialization.load_ssh_private_key` now
    raises a TypeError if the key is unencrypted but a password
    is provided (previously no exception was raised), and raises
    a TypeError if the key is encrypted but no password is
    provided (previously a ValueError was raised).
  * Added __copy__ to the :class:`~cryptography.hazmat.primitives
    .asymmetric.ec.EllipticCurvePrivateKey`, :class:`~cryptograph
    y.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey`, :c
    lass:`~cryptography.hazmat.primitives.asymmetric.ed25519.Ed25
    519PublicKey`, :class:`~cryptography.hazmat.primitives.asymme
    tric.ed25519.Ed25519PrivateKey`, :class:`~cryptography.hazmat
    .primitives.asymmetric.ed448.Ed448PublicKey`, :class:`~crypto
    graphy.hazmat.primitives.asymmetric.ed448.Ed448PrivateKey`, :
    class:`~cryptography.hazmat.primitives.asymmetric.x25519.X255
    19PublicKey`, :class:`~cryptography.hazmat.primitives.asymmet
    ric.x25519.X25519PrivateKey`, :class:`~cryptography.hazmat.pr
    imitives.asymmetric.x448.X448PublicKey`, :class:`~cryptograph
    y.hazmat.primitives.asymmetric.x448.X448PrivateKey`, :class:`
    ~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey`
    , :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAP
    ublicKey`, :class:`~cryptography.hazmat.primitives.asymmetric
    .dsa.DSAPrivateKey`, :class:`~cryptography.hazmat.primitives.
    asymmetric.dsa.DSAPublicKey`, :class:`~cryptography.hazmat.pr
    imitives.asymmetric.dh.DHPrivateKey`, and :class:`~cryptograp
    hy.hazmat.primitives.asymmetric.dh.DHPublicKey` abstract base
    classes.
  * We significantly refactored how private key loading ( :func:`
    ~cryptography.hazmat.primitives.serialization.load_pem_privat
    e_key` and :func:`~cryptography.hazmat.primitives.serializati
    on.load_der_private_key`) works. This is intended to be
    backwards compatible for all well-formed keys, therefore if
    you discover a key that now raises an exception, please file
    a bug with instructions for reproducing.
  * Added unsafe_skip_rsa_key_validation keyword-argument to :fun
    c:`~cryptography.hazmat.primitives.serialization.load_ssh_pri
    vate_key`.
  * Added :class:`~cryptography.hazmat.primitives.hashes.XOFHash`
    to support repeated :meth:`~cryptography.hazmat.primitives.ha
    shes.XOFHash.squeeze` operations on extendable output
    functions.
  * Added :meth:`~cryptography.x509.ocsp.OCSPResponseBuilder.add_
    response_by_hash` method to allow creating OCSP responses
    using certificate hash values rather than full certificates.
  * Extended the :mod:`X.509 path validation
    &lt;cryptography.x509.verification&gt;` API to support user-
    configured extension policies via the
    :meth:`PolicyBuilder.extension_policies &lt;cryptography.x509.ve
    rification.PolicyBuilder.extension_policies&gt;` method.
  * Deprecated the subject, verification_time and max_chain_depth
    properties on
    :class:`~cryptography.x509.verification.ClientVerifier` and
    :class:`~cryptography.x509.verification.ServerVerifier` in
    favor of a new policy property. These properties will be
    removed in the next release of cryptography.
  * BACKWARDS INCOMPATIBLE: The :meth:`VerifiedClient.subject
    &lt;cryptography.x509.verification.VerifiedClient.subjects&gt;`
    property can now be None since a custom extension policy may
    allow certificates without a Subject Alternative Name
    extension.
  * Changed the behavior when the OpenSSL 3 legacy provider fails
    to load. Instead of raising an exception, a warning is now
    emitted. The CRYPTOGRAPHY_OPENSSL_NO_LEGACY environment
    variable can still be used to disable the legacy provider at
    runtime.
  * Added support for the CRYPTOGRAPHY_BUILD_OPENSSL_NO_LEGACY
    environment variable during build time, which prevents the
    library from ever attempting to load the legacy provider.
  * Added support for the
    :class:`~cryptography.x509.PrivateKeyUsagePeriod` X.509
    extension. This extension defines the period during which the
    private key corresponding to the certificate's public key may
    be used.
  * Added support for compiling against `aws-lc`_.
  * Parsing X.509 structures now more strictly enforces that Name
    structures do not have malformed ASN.1.
  * We now publish py311 wheels that utilize the faster
    pyo3::buffer::PyBuffer interface, resulting in significantly
    improved performance for operations involving small buffers.
  * Added :func:`~cryptography.hazmat.primitives.serialization.ss
    h_key_fingerprint` for computing fingerprints of SSH public
    keys.
  * Added support for deterministic ECDSA signing via the new
    keyword-only argument ecdsa_deterministic in
    :meth:`~cryptography.x509.CertificateBuilder.sign`, :meth:`~c
    ryptography.x509.CertificateRevocationListBuilder.sign` and :
    meth:`~cryptography.x509.CertificateSigningRequestBuilder.sig
    n`.</changelog>
  <changelog author="James Oakley &lt;jfunk@opensuse.org&gt;" date="1756728000">- Add Make-unsafe-subinterpreter-support-available-via-cfg.patch
  to allow ceph-mgr to load modules (boo#1248987)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1757851200">- update to 45.0.7:
  * Added a function to support an upcoming pyOpenSSL release.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1760356800">- update to 46.0.2:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.4.
  * Fixed an issue where users installing via pip on Python 3.14
    development versions would not properly install a dependency.
  * Fixed an issue building the free-threaded macOS 3.14 wheels.
  * BACKWARDS INCOMPATIBLE: Support for Python 3.7 has been
    removed.
  * Support for OpenSSL &lt; 3.0 is deprecated and will be removed
    in the next release.
  * Support for x86_64 macOS (including publishing wheels) is
    deprecated and will be removed in two releases. We will
    switch to publishing an arm64 only wheel for macOS.
  * Support for 32-bit Windows (including publishing wheels) is
    deprecated and will be removed in two releases. Users should
    move to a 64-bit Python installation.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.3.
  * We now build ppc64le manylinux wheels and publish them to
    PyPI.
  * We now build win_arm64 (Windows on Arm) wheels and publish
    them to PyPI.
  * Added support for free-threaded Python 3.14.
  * Removed the deprecated get_attribute_for_oid method on
    :class:`~cryptography.x509.CertificateSigningRequest`. Users
    should use
    :meth:`~cryptography.x509.Attributes.get_attribute_for_oid`
    instead.
  * Removed the deprecated CAST5, SEED, IDEA, and Blowfish
    classes from the cipher module. These are still available in
    :doc:`/hazmat/decrepit/index`.
  * In X.509, when performing a PSS signature with a SHA-3 hash,
    it is now encoded with the official NIST SHA3 OID.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1765195200">- Only require pytest-subtests with pytest &lt; 9.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1770897600">- Update to 46.0.5 (fixes CVE-2026-26007, bsc#1258074)
  * An attacker could create a malicious public key that reveals portions of
    your private key when using certain uncommon elliptic curves (binary
    curves). This version now includes additional security checks to prevent
    this attack. This issue only affects binary elliptic curves, which are
    rarely used in real-world applications. Credit to XlabAI Team of Tencent
    Xuanwu Lab and Atuin Automated Vulnerability Discovery Engine for reporting
    the issue. CVE-2026-26007
  * Support for SECT* binary elliptic curves is deprecated and will be removed
    in the next release.
- Update to 46.0.4
  * Dropped support for win_arm64 wheels.
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.5.
- Update to 46.0.3
  * Fixed compilation when using LibreSSL 4.2.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1774612800">- update to 46.0.6 (CVE-2026-34073, bsc#1260876):
  * SECURITY ISSUE: Fixed a bug where name constraints were not
    applied to peer names during verification when the leaf
    certificate contains a wildcard DNS SAN. Ordinary X.509
    topologies are not affected by this bug, including those used
    by the Web PKI. Credit to Oleh Konko (1seal) for reporting
    the issue. CVE-2026-34073</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1774958400">- Add patch support-maturin-1.12.patch:
  * Correctly deal with maturin bugfix that installs tests and
    docs under sitearch.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1775822400">- Update to 46.0.7 (fixes CVE-2026-39892, bsc#1261863)
  * **SECURITY ISSUE**: Fixed an issue where non-contiguous buffers could be
    passed to APIs that accept Python buffers, which could lead to buffer
    overflow. **CVE-2026-39892**
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.6.
- drop support-maturin-1.12.patch (upstream)
- drop no-pytest_benchmark.patch,
  Make-unsafe-subinterpreter-support-available-via-cfg.patch:
  obsolete</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1777204800">- update to 47.0.0:
  * Support for Python 3.8 is deprecated and will be removed in
    the next cryptography release.
  * BACKWARDS INCOMPATIBLE: Support for binary elliptic curves
    (SECT* classes) has been removed. These curves are rarely
    used and have additional security considerations that make
    them undesirable.
  * BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.1.x has been
    removed. OpenSSL 3.0.0 or later is now required. LibreSSL,
    BoringSSL, and AWS-LC continue to be supported.
  * BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL &lt; 4.1.
  * BACKWARDS INCOMPATIBLE: Loading keys with unsupported
    algorithms or keys with unsupported explicit curve encodings
    now raises
    :class:`~cryptography.exceptions.UnsupportedAlgorithm`
    instead of ValueError. This change affects :func:`~cryptograp
    hy.hazmat.primitives.serialization.load_pem_private_key`, :fu
    nc:`~cryptography.hazmat.primitives.serialization.load_der_pr
    ivate_key`, :func:`~cryptography.hazmat.primitives.serializat
    ion.load_pem_public_key`, :func:`~cryptography.hazmat.primiti
    ves.serialization.load_der_public_key`, and
    :meth:`~cryptography.x509.Certificate.public_key` when called
    on certificates with unsupported public key algorithms.
  * BACKWARDS INCOMPATIBLE: When parsing elliptic curve private
    keys, we now reject keys that incorrectly encode a private
    key of the wrong length because such keys are impossible to
    process in a constant-time manner. We do not believe keys
    with this problem are in wide use, however we may revert this
    change based on the feedback we receive.
  * Deprecated passing 64-bit (8-byte) and 128-bit (16-byte) keys
    to :class:`~cryptography.hazmat.decrepit.ciphers.algorithms.T
    ripleDES`. In a future release, only 192-bit (24-byte) keys
    will be accepted. Users should expand shorter keys themselves
    (e.g., for single DES: key + key + key, for two-key: key +
    key[:8]).
  * Updated the minimum supported Rust version (MSRV) to 1.83.0,
    from 1.74.0.
  * Support for x86_64 macOS (including publishing wheels) is
    deprecated and will be removed in the next release. We will
    switch to publishing an arm64 only wheel for macOS.
  * Support for 32-bit Windows (including publishing wheels) is
    deprecated and will be removed in the next release. Users
    should move to a 64-bit Python installation.
  * public_bytes and private_bytes methods on keys now raise
    TypeError (instead of ValueError) if an invalid encoding is
    provided for the given format.
  * Moved
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.CFB`,
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.OFB`, and
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.CFB8`
    into :doc:`/hazmat/decrepit/index` and deprecated them in the
    modes module. They will be removed from the modes module in
    49.0.0.
  * Moved :class:`~cryptography.hazmat.primitives.ciphers.algorit
    hms.Camellia` into  :doc:`/hazmat/decrepit/index` and
    deprecated it in the cipher module. It will be removed from
    the cipher module in 49.0.0.
  * Added
    :meth:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF.extract`
    to :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF`.
    The previous private implementation will be removed in
    49.0.0.
  * Added support for loading elliptic curve keys that contain
    explicit encodings of the curves secp256r1, secp384r1, and
    secp521r1.
  * Added support for
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2d`
    and
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2i`
    when using OpenSSL 3.2.0+.
  * Added derive_into methods to
    :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF`,
    :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDFExpand`,
    :class:`~cryptography.hazmat.primitives.kdf.concatkdf.ConcatK
    DFHash`, :class:`~cryptography.hazmat.primitives.kdf.concatkd
    f.ConcatKDFHMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2id`,
    :class:`~cryptography.hazmat.primitives.kdf.pbkdf2.PBKDF2HMAC
    `,
    :class:`~cryptography.hazmat.primitives.kdf.kbkdf.KBKDFHMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.kbkdf.KBKDFCMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.scrypt.Scrypt`,
    and
    :class:`~cryptography.hazmat.primitives.kdf.x963kdf.X963KDF`
    to allow deriving keys directly into pre-allocated buffers.
  * Added encrypt_into and decrypt_into methods to
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESCCM`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESGCM`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESGCMSI
    V`, :class:`~cryptography.hazmat.primitives.ciphers.aead.AESO
    CB3`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESSIV`,
    and :class:`~cryptography.hazmat.primitives.ciphers.aead.ChaC
    ha20Poly1305` to allow encrypting directly into a pre-
    allocated buffer.
  * Added support for PKCS1v15 signing without DigestInfo using :
    class:`~cryptography.hazmat.primitives.asymmetric.utils.NoDig
    estInfo`.
  * Added
    :meth:`~cryptography.hazmat.primitives.hashes.Hash.hash`, a
    one-shot method for computing hashes.
  * Added :doc:`/hazmat/primitives/hpke` support implementing RFC
    9180 for hybrid authenticated encryption.
  * Added new :doc:`/hazmat/primitives/asymmetric/mlkem` module
    with support for ML-KEM key encapsulation with AWS-LC and
    BoringSSL. Note: Post-quantum algorithm support requires AWS-
    LC or BoringSSL. As we ship our wheels with OpenSSL, most
    users will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Note: Post-quantum algorithm support requires AWS-LC or
    BoringSSL. As we ship our wheels with OpenSSL, most users
    will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Added new :doc:`/hazmat/primitives/asymmetric/mldsa` module
    with support for ML-DSA signing and verification with AWS-LC
    and BoringSSL. Note: Post-quantum algorithm support requires
    AWS-LC or BoringSSL. As we ship our wheels with OpenSSL, most
    users will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Note: Post-quantum algorithm support requires AWS-LC or
    BoringSSL. As we ship our wheels with OpenSSL, most users
    will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Added new :doc:`/hazmat/asn1/index` module with support for
    declaratively defining custom ASN.1 types and
    encoding/decoding them.
  * Fixed compilation when using LibreSSL 4.3.0 and OpenSSL
    4.0.0.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 4.0.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1778414400">- update to 48.0.0:
  * BACKWARDS INCOMPATIBLE: Support for Python 3.8 has been
    removed. cryptography now requires Python 3.9 or later.
  * BACKWARDS INCOMPATIBLE: Loading an X.509 CRL whose inner
    TBSCertList.signature algorithm does not match the outer
    signatureAlgorithm now raises ValueError. Previously, such
    CRLs were parsed successfully and only rejected during
    signature validation.
  * Added support for :doc:`/hazmat/primitives/asymmetric/mlkem`
    and :doc:`/hazmat/primitives/asymmetric/mldsa` when using
    OpenSSL 3.5.0 or later, in addition to the existing AWS-LC
    and BoringSSL support. This means post-quantum algorithms are
    now available to users of our wheels. Note: Going forward, we
    do not guarantee that all functionality in cryptography will
    be available when building against OpenSSL. See
    :doc:`/statements/state-of-openssl` for more information.
  * Note: Going forward, we do not guarantee that all
    functionality in cryptography will be available when building
    against OpenSSL. See :doc:`/statements/state-of-openssl` for
    more information.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1781438400">- update to 49.0.0:
  * BACKWARDS INCOMPATIBLE: Removed the deprecated
    PUBLIC_KEY_TYPES, PRIVATE_KEY_TYPES,
    CERTIFICATE_PRIVATE_KEY_TYPES,
    CERTIFICATE_ISSUER_PUBLIC_KEY_TYPES, and
    CERTIFICATE_PUBLIC_KEY_TYPES type aliases. Use
    PublicKeyTypes, PrivateKeyTypes,
    CertificateIssuerPrivateKeyTypes,
    CertificateIssuerPublicKeyTypes, and
    CertificatePublicKeyTypes instead. These were deprecated in
    version 40.0.
  * BACKWARDS INCOMPATIBLE: :class:`~cryptography.hazmat.primitiv
    es.ciphers.algorithms.ChaCha20` now treats the first 4 bytes
    of the nonce as a 32-bit little-endian block counter (as
    defined in RFC 7539) and tracks the number of bytes
    processed. Attempting to encrypt or decrypt more data than
    the counter allows before it would overflow now raises a
    :class:`ValueError` rather than silently diverging from RFC
    7539. Setting the counter portion of the nonce to zero allows
    encrypting up to 256 GiB with a given nonce.
  * BACKWARDS INCOMPATIBLE: Loading an X.509 certificate whose
    ECDSA or DSA signature AlgorithmIdentifier contains encoded
    NULL parameters now raises a :class:`ValueError`. Such
    certificates are invalid, but older versions of Java emitted
    them; previously they loaded with a deprecation warning.
  * Fixed cross-compilation of the CFFI bindings when
    PYO3_CROSS_LIB_DIR is set. The build now derives the Python
    include directory from PYO3_CROSS_LIB_DIR instead of querying
    the host interpreter, which previously caused the build to
    fail during cross-compilations for embedded systems, on hosts
    which have same-version Python development headers installed
    as the target Python.
  * Added support for signing and verifying X.509 certificates,
    certificate signing requests, and certificate revocation
    lists with :doc:`/hazmat/primitives/asymmetric/mldsa` keys,
    as well as loading certificates that contain ML-DSA public
    keys.
  * Added
    :meth:`~cryptography.hazmat.primitives.hpke.KEM.enc_length`
    to :class:`~cryptography.hazmat.primitives.hpke.KEM` so
    callers can split the encapsulated key from the ciphertext
    returned by
    :meth:`~cryptography.hazmat.primitives.hpke.Suite.encrypt`.
  * :meth:`~cryptography.x509.verification.ExtensionPolicy.requir
    e_present`, :meth:`~cryptography.x509.verification.ExtensionP
    olicy.may_be_present`, and :meth:`~cryptography.x509.verifica
    tion.ExtensionPolicy.require_not_present` now accept any
    extension type. Previously only a fixed set of extension
    types was supported, which made it impossible to account for
    otherwise unrecognized critical extensions during path
    validation.
  * Added support for using
    :class:`~cryptography.x509.Certificate`,
    :class:`~cryptography.x509.CertificateSigningRequest`, and
    :class:`~cryptography.x509.CertificateRevocationList` as
    field types in :doc:`/hazmat/asn1/index` structures.
  * Added :func:`~cryptography.hazmat.asn1.value_set`, a class
    decorator that registers an :class:`enum.Enum` subclass as an
    ASN.1 value set: members are encoded as their underlying
    value, and decoding fails if the decoded value does not match
    one of the declared members.
  * Added :meth:`~cryptography.x509.Name.from_bytes` for parsing
    a :class:`~cryptography.x509.Name` from DER bytes, the
    inverse of :meth:`~cryptography.x509.Name.public_bytes`.
  * Added the rsa_padding keyword-only parameter to
    :meth:`~cryptography.x509.CertificateBuilder.public_key`.
    Passing the :class:`~cryptography.hazmat.primitives.asymmetri
    c.padding.PSS` class (not an instance) encodes an RSA subject
    public key in the certificate's subjectPublicKeyInfo with the
    id-RSASSA-PSS OID and no parameters.
  * Added external mu (message representative) support to
    :doc:`/hazmat/primitives/asymmetric/mldsa` via the sign_mu
    and verify_mu methods, which sign and verify a precomputed
    64-byte mu as defined in FIPS 204.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 4.0.1.</changelog>
</package>
<package pkgid="b3267c2d9d2ddb1d01fcc460714b965c4c6506eca4c4a972b6f669e2e5f69f1c82785f8e2404af71e8dfb6bf7a90726e4392ddb3c2fd84c8457ffc0ca94a5545" name="python-cryptography-debuginfo" arch="armv7hl">
  <version epoch="0" ver="49.0.0" rel="289.3"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1727524800">- update to 43.0.1:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.3.2.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1729598400">- update to 43.0.3:
  * Fixed release metadata for cryptography-vectors
  * Fixed compilation when using LibreSSL 4.0.0.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1730808000">- Avoid using requires_eq, which after the last modifications
  conflicts with python singlespec (order of expansion).</changelog>
  <changelog author="Ben Greiner &lt;code@bnavigator.de&gt;" date="1731067200">- Fix requires_eq replacement for distributions which do not have
  python3-cffi installed (such as SLE15 python module pythons)
  * gh#openSUSE/python-rpm-macros#185
- Remove outdated section in description</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfyhalomacro@opensuse.org&gt;" date="1737892800">- Update to version 44.0.0:
  * BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL &lt; 3.9.
  * Deprecated Python 3.7 support. Python 3.7 is no longer supported by
    the Python core team. Support for Python 3.7 will be removed in a future
    cryptography release.
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.4.0.
  * macOS wheels are now built against the macOS 10.13 SDK. Users on older
    versions of macOS should upgrade, or they will need to build cryptography
    themselves.
  * Enforce the RFC 5280 requirement that extended key usage extensions must not be empty.
  * Added support for timestamp extraction to the :class:`~cryptography.fernet.MultiFernet` class.
  * Relax the Authority Key Identifier requirements on root CA certificates
    during X.509 verification to allow fields permitted by RFC 5280 but
    forbidden by the CA/Browser BRs.
  * Added support for
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2id` when using
    OpenSSL 3.2.0+.
  * Added support for the :class:`~cryptography.x509.Admissions` certificate extension.
  * Added basic support for PKCS7 decryption (including S/MIME 3.2) via
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der`,
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_pem`,
    and :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_smime`.
- Update specfile to accommodate new project structure at version 44.0.0
- Update no-pytest_benchmark.patch</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1740571200">- update to 44.0.1:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.4.1.
  * We now build armv7l manylinux wheels and publish them to
    PyPI.
  * We now build manylinux_2_34 wheels and publish them to PyPI.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1742731200">- update to 44.0.2:
  * We now build wheels for PyPy 3.11.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1746619200">- Update to 44.0.3
  * Fixed compilation when using LibreSSL 4.1.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1752321600">- update to 45.0.5:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.1.
  * Fixed decrypting PKCS#8 files encrypted with SHA1-RC4. (This
    is not considered secure, and is supported only for backwards
    compatibility.)
  * Fixed decrypting PKCS#8 files encrypted with long salts (this
    impacts keys encrypted by Bouncy Castle).
  * Fixed decrypting PKCS#8 files encrypted with DES-CBC-MD5.
    While wildly insecure, this remains prevalent.
  * Fixed using mypy with cryptography on older versions of
    Python.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.0.
  * Support for Python 3.7 is deprecated and will be removed in
    the next cryptography release.
  * Updated the minimum supported Rust version (MSRV) to 1.74.0,
    from 1.65.0.
  * Added support for serialization of PKCS#12 Java truststores
    in :func:`~cryptography.hazmat.primitives.serialization.pkcs1
    2.serialize_java_truststore`
  * Added :meth:`~cryptography.hazmat.primitives.kdf.argon2.Argon
    2id.derive_phc_encoded` and :meth:`~cryptography.hazmat.primi
    tives.kdf.argon2.Argon2id.verify_phc_encoded` methods to
    support password hashing in the PHC string format
  * Added support for PKCS7 decryption and encryption using
    AES-256 as the content algorithm, in addition to AES-128.
  * BACKWARDS INCOMPATIBLE: Made SSH private key loading more
    consistent with other private key loading: :func:`~cryptograp
    hy.hazmat.primitives.serialization.load_ssh_private_key` now
    raises a TypeError if the key is unencrypted but a password
    is provided (previously no exception was raised), and raises
    a TypeError if the key is encrypted but no password is
    provided (previously a ValueError was raised).
  * Added __copy__ to the :class:`~cryptography.hazmat.primitives
    .asymmetric.ec.EllipticCurvePrivateKey`, :class:`~cryptograph
    y.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey`, :c
    lass:`~cryptography.hazmat.primitives.asymmetric.ed25519.Ed25
    519PublicKey`, :class:`~cryptography.hazmat.primitives.asymme
    tric.ed25519.Ed25519PrivateKey`, :class:`~cryptography.hazmat
    .primitives.asymmetric.ed448.Ed448PublicKey`, :class:`~crypto
    graphy.hazmat.primitives.asymmetric.ed448.Ed448PrivateKey`, :
    class:`~cryptography.hazmat.primitives.asymmetric.x25519.X255
    19PublicKey`, :class:`~cryptography.hazmat.primitives.asymmet
    ric.x25519.X25519PrivateKey`, :class:`~cryptography.hazmat.pr
    imitives.asymmetric.x448.X448PublicKey`, :class:`~cryptograph
    y.hazmat.primitives.asymmetric.x448.X448PrivateKey`, :class:`
    ~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey`
    , :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAP
    ublicKey`, :class:`~cryptography.hazmat.primitives.asymmetric
    .dsa.DSAPrivateKey`, :class:`~cryptography.hazmat.primitives.
    asymmetric.dsa.DSAPublicKey`, :class:`~cryptography.hazmat.pr
    imitives.asymmetric.dh.DHPrivateKey`, and :class:`~cryptograp
    hy.hazmat.primitives.asymmetric.dh.DHPublicKey` abstract base
    classes.
  * We significantly refactored how private key loading ( :func:`
    ~cryptography.hazmat.primitives.serialization.load_pem_privat
    e_key` and :func:`~cryptography.hazmat.primitives.serializati
    on.load_der_private_key`) works. This is intended to be
    backwards compatible for all well-formed keys, therefore if
    you discover a key that now raises an exception, please file
    a bug with instructions for reproducing.
  * Added unsafe_skip_rsa_key_validation keyword-argument to :fun
    c:`~cryptography.hazmat.primitives.serialization.load_ssh_pri
    vate_key`.
  * Added :class:`~cryptography.hazmat.primitives.hashes.XOFHash`
    to support repeated :meth:`~cryptography.hazmat.primitives.ha
    shes.XOFHash.squeeze` operations on extendable output
    functions.
  * Added :meth:`~cryptography.x509.ocsp.OCSPResponseBuilder.add_
    response_by_hash` method to allow creating OCSP responses
    using certificate hash values rather than full certificates.
  * Extended the :mod:`X.509 path validation
    &lt;cryptography.x509.verification&gt;` API to support user-
    configured extension policies via the
    :meth:`PolicyBuilder.extension_policies &lt;cryptography.x509.ve
    rification.PolicyBuilder.extension_policies&gt;` method.
  * Deprecated the subject, verification_time and max_chain_depth
    properties on
    :class:`~cryptography.x509.verification.ClientVerifier` and
    :class:`~cryptography.x509.verification.ServerVerifier` in
    favor of a new policy property. These properties will be
    removed in the next release of cryptography.
  * BACKWARDS INCOMPATIBLE: The :meth:`VerifiedClient.subject
    &lt;cryptography.x509.verification.VerifiedClient.subjects&gt;`
    property can now be None since a custom extension policy may
    allow certificates without a Subject Alternative Name
    extension.
  * Changed the behavior when the OpenSSL 3 legacy provider fails
    to load. Instead of raising an exception, a warning is now
    emitted. The CRYPTOGRAPHY_OPENSSL_NO_LEGACY environment
    variable can still be used to disable the legacy provider at
    runtime.
  * Added support for the CRYPTOGRAPHY_BUILD_OPENSSL_NO_LEGACY
    environment variable during build time, which prevents the
    library from ever attempting to load the legacy provider.
  * Added support for the
    :class:`~cryptography.x509.PrivateKeyUsagePeriod` X.509
    extension. This extension defines the period during which the
    private key corresponding to the certificate's public key may
    be used.
  * Added support for compiling against `aws-lc`_.
  * Parsing X.509 structures now more strictly enforces that Name
    structures do not have malformed ASN.1.
  * We now publish py311 wheels that utilize the faster
    pyo3::buffer::PyBuffer interface, resulting in significantly
    improved performance for operations involving small buffers.
  * Added :func:`~cryptography.hazmat.primitives.serialization.ss
    h_key_fingerprint` for computing fingerprints of SSH public
    keys.
  * Added support for deterministic ECDSA signing via the new
    keyword-only argument ecdsa_deterministic in
    :meth:`~cryptography.x509.CertificateBuilder.sign`, :meth:`~c
    ryptography.x509.CertificateRevocationListBuilder.sign` and :
    meth:`~cryptography.x509.CertificateSigningRequestBuilder.sig
    n`.</changelog>
  <changelog author="James Oakley &lt;jfunk@opensuse.org&gt;" date="1756728000">- Add Make-unsafe-subinterpreter-support-available-via-cfg.patch
  to allow ceph-mgr to load modules (boo#1248987)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1757851200">- update to 45.0.7:
  * Added a function to support an upcoming pyOpenSSL release.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1760356800">- update to 46.0.2:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.4.
  * Fixed an issue where users installing via pip on Python 3.14
    development versions would not properly install a dependency.
  * Fixed an issue building the free-threaded macOS 3.14 wheels.
  * BACKWARDS INCOMPATIBLE: Support for Python 3.7 has been
    removed.
  * Support for OpenSSL &lt; 3.0 is deprecated and will be removed
    in the next release.
  * Support for x86_64 macOS (including publishing wheels) is
    deprecated and will be removed in two releases. We will
    switch to publishing an arm64 only wheel for macOS.
  * Support for 32-bit Windows (including publishing wheels) is
    deprecated and will be removed in two releases. Users should
    move to a 64-bit Python installation.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.3.
  * We now build ppc64le manylinux wheels and publish them to
    PyPI.
  * We now build win_arm64 (Windows on Arm) wheels and publish
    them to PyPI.
  * Added support for free-threaded Python 3.14.
  * Removed the deprecated get_attribute_for_oid method on
    :class:`~cryptography.x509.CertificateSigningRequest`. Users
    should use
    :meth:`~cryptography.x509.Attributes.get_attribute_for_oid`
    instead.
  * Removed the deprecated CAST5, SEED, IDEA, and Blowfish
    classes from the cipher module. These are still available in
    :doc:`/hazmat/decrepit/index`.
  * In X.509, when performing a PSS signature with a SHA-3 hash,
    it is now encoded with the official NIST SHA3 OID.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1765195200">- Only require pytest-subtests with pytest &lt; 9.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1770897600">- Update to 46.0.5 (fixes CVE-2026-26007, bsc#1258074)
  * An attacker could create a malicious public key that reveals portions of
    your private key when using certain uncommon elliptic curves (binary
    curves). This version now includes additional security checks to prevent
    this attack. This issue only affects binary elliptic curves, which are
    rarely used in real-world applications. Credit to XlabAI Team of Tencent
    Xuanwu Lab and Atuin Automated Vulnerability Discovery Engine for reporting
    the issue. CVE-2026-26007
  * Support for SECT* binary elliptic curves is deprecated and will be removed
    in the next release.
- Update to 46.0.4
  * Dropped support for win_arm64 wheels.
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.5.
- Update to 46.0.3
  * Fixed compilation when using LibreSSL 4.2.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1774612800">- update to 46.0.6 (CVE-2026-34073, bsc#1260876):
  * SECURITY ISSUE: Fixed a bug where name constraints were not
    applied to peer names during verification when the leaf
    certificate contains a wildcard DNS SAN. Ordinary X.509
    topologies are not affected by this bug, including those used
    by the Web PKI. Credit to Oleh Konko (1seal) for reporting
    the issue. CVE-2026-34073</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1774958400">- Add patch support-maturin-1.12.patch:
  * Correctly deal with maturin bugfix that installs tests and
    docs under sitearch.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1775822400">- Update to 46.0.7 (fixes CVE-2026-39892, bsc#1261863)
  * **SECURITY ISSUE**: Fixed an issue where non-contiguous buffers could be
    passed to APIs that accept Python buffers, which could lead to buffer
    overflow. **CVE-2026-39892**
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.6.
- drop support-maturin-1.12.patch (upstream)
- drop no-pytest_benchmark.patch,
  Make-unsafe-subinterpreter-support-available-via-cfg.patch:
  obsolete</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1777204800">- update to 47.0.0:
  * Support for Python 3.8 is deprecated and will be removed in
    the next cryptography release.
  * BACKWARDS INCOMPATIBLE: Support for binary elliptic curves
    (SECT* classes) has been removed. These curves are rarely
    used and have additional security considerations that make
    them undesirable.
  * BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.1.x has been
    removed. OpenSSL 3.0.0 or later is now required. LibreSSL,
    BoringSSL, and AWS-LC continue to be supported.
  * BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL &lt; 4.1.
  * BACKWARDS INCOMPATIBLE: Loading keys with unsupported
    algorithms or keys with unsupported explicit curve encodings
    now raises
    :class:`~cryptography.exceptions.UnsupportedAlgorithm`
    instead of ValueError. This change affects :func:`~cryptograp
    hy.hazmat.primitives.serialization.load_pem_private_key`, :fu
    nc:`~cryptography.hazmat.primitives.serialization.load_der_pr
    ivate_key`, :func:`~cryptography.hazmat.primitives.serializat
    ion.load_pem_public_key`, :func:`~cryptography.hazmat.primiti
    ves.serialization.load_der_public_key`, and
    :meth:`~cryptography.x509.Certificate.public_key` when called
    on certificates with unsupported public key algorithms.
  * BACKWARDS INCOMPATIBLE: When parsing elliptic curve private
    keys, we now reject keys that incorrectly encode a private
    key of the wrong length because such keys are impossible to
    process in a constant-time manner. We do not believe keys
    with this problem are in wide use, however we may revert this
    change based on the feedback we receive.
  * Deprecated passing 64-bit (8-byte) and 128-bit (16-byte) keys
    to :class:`~cryptography.hazmat.decrepit.ciphers.algorithms.T
    ripleDES`. In a future release, only 192-bit (24-byte) keys
    will be accepted. Users should expand shorter keys themselves
    (e.g., for single DES: key + key + key, for two-key: key +
    key[:8]).
  * Updated the minimum supported Rust version (MSRV) to 1.83.0,
    from 1.74.0.
  * Support for x86_64 macOS (including publishing wheels) is
    deprecated and will be removed in the next release. We will
    switch to publishing an arm64 only wheel for macOS.
  * Support for 32-bit Windows (including publishing wheels) is
    deprecated and will be removed in the next release. Users
    should move to a 64-bit Python installation.
  * public_bytes and private_bytes methods on keys now raise
    TypeError (instead of ValueError) if an invalid encoding is
    provided for the given format.
  * Moved
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.CFB`,
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.OFB`, and
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.CFB8`
    into :doc:`/hazmat/decrepit/index` and deprecated them in the
    modes module. They will be removed from the modes module in
    49.0.0.
  * Moved :class:`~cryptography.hazmat.primitives.ciphers.algorit
    hms.Camellia` into  :doc:`/hazmat/decrepit/index` and
    deprecated it in the cipher module. It will be removed from
    the cipher module in 49.0.0.
  * Added
    :meth:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF.extract`
    to :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF`.
    The previous private implementation will be removed in
    49.0.0.
  * Added support for loading elliptic curve keys that contain
    explicit encodings of the curves secp256r1, secp384r1, and
    secp521r1.
  * Added support for
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2d`
    and
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2i`
    when using OpenSSL 3.2.0+.
  * Added derive_into methods to
    :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF`,
    :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDFExpand`,
    :class:`~cryptography.hazmat.primitives.kdf.concatkdf.ConcatK
    DFHash`, :class:`~cryptography.hazmat.primitives.kdf.concatkd
    f.ConcatKDFHMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2id`,
    :class:`~cryptography.hazmat.primitives.kdf.pbkdf2.PBKDF2HMAC
    `,
    :class:`~cryptography.hazmat.primitives.kdf.kbkdf.KBKDFHMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.kbkdf.KBKDFCMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.scrypt.Scrypt`,
    and
    :class:`~cryptography.hazmat.primitives.kdf.x963kdf.X963KDF`
    to allow deriving keys directly into pre-allocated buffers.
  * Added encrypt_into and decrypt_into methods to
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESCCM`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESGCM`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESGCMSI
    V`, :class:`~cryptography.hazmat.primitives.ciphers.aead.AESO
    CB3`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESSIV`,
    and :class:`~cryptography.hazmat.primitives.ciphers.aead.ChaC
    ha20Poly1305` to allow encrypting directly into a pre-
    allocated buffer.
  * Added support for PKCS1v15 signing without DigestInfo using :
    class:`~cryptography.hazmat.primitives.asymmetric.utils.NoDig
    estInfo`.
  * Added
    :meth:`~cryptography.hazmat.primitives.hashes.Hash.hash`, a
    one-shot method for computing hashes.
  * Added :doc:`/hazmat/primitives/hpke` support implementing RFC
    9180 for hybrid authenticated encryption.
  * Added new :doc:`/hazmat/primitives/asymmetric/mlkem` module
    with support for ML-KEM key encapsulation with AWS-LC and
    BoringSSL. Note: Post-quantum algorithm support requires AWS-
    LC or BoringSSL. As we ship our wheels with OpenSSL, most
    users will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Note: Post-quantum algorithm support requires AWS-LC or
    BoringSSL. As we ship our wheels with OpenSSL, most users
    will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Added new :doc:`/hazmat/primitives/asymmetric/mldsa` module
    with support for ML-DSA signing and verification with AWS-LC
    and BoringSSL. Note: Post-quantum algorithm support requires
    AWS-LC or BoringSSL. As we ship our wheels with OpenSSL, most
    users will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Note: Post-quantum algorithm support requires AWS-LC or
    BoringSSL. As we ship our wheels with OpenSSL, most users
    will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Added new :doc:`/hazmat/asn1/index` module with support for
    declaratively defining custom ASN.1 types and
    encoding/decoding them.
  * Fixed compilation when using LibreSSL 4.3.0 and OpenSSL
    4.0.0.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 4.0.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1778414400">- update to 48.0.0:
  * BACKWARDS INCOMPATIBLE: Support for Python 3.8 has been
    removed. cryptography now requires Python 3.9 or later.
  * BACKWARDS INCOMPATIBLE: Loading an X.509 CRL whose inner
    TBSCertList.signature algorithm does not match the outer
    signatureAlgorithm now raises ValueError. Previously, such
    CRLs were parsed successfully and only rejected during
    signature validation.
  * Added support for :doc:`/hazmat/primitives/asymmetric/mlkem`
    and :doc:`/hazmat/primitives/asymmetric/mldsa` when using
    OpenSSL 3.5.0 or later, in addition to the existing AWS-LC
    and BoringSSL support. This means post-quantum algorithms are
    now available to users of our wheels. Note: Going forward, we
    do not guarantee that all functionality in cryptography will
    be available when building against OpenSSL. See
    :doc:`/statements/state-of-openssl` for more information.
  * Note: Going forward, we do not guarantee that all
    functionality in cryptography will be available when building
    against OpenSSL. See :doc:`/statements/state-of-openssl` for
    more information.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1781438400">- update to 49.0.0:
  * BACKWARDS INCOMPATIBLE: Removed the deprecated
    PUBLIC_KEY_TYPES, PRIVATE_KEY_TYPES,
    CERTIFICATE_PRIVATE_KEY_TYPES,
    CERTIFICATE_ISSUER_PUBLIC_KEY_TYPES, and
    CERTIFICATE_PUBLIC_KEY_TYPES type aliases. Use
    PublicKeyTypes, PrivateKeyTypes,
    CertificateIssuerPrivateKeyTypes,
    CertificateIssuerPublicKeyTypes, and
    CertificatePublicKeyTypes instead. These were deprecated in
    version 40.0.
  * BACKWARDS INCOMPATIBLE: :class:`~cryptography.hazmat.primitiv
    es.ciphers.algorithms.ChaCha20` now treats the first 4 bytes
    of the nonce as a 32-bit little-endian block counter (as
    defined in RFC 7539) and tracks the number of bytes
    processed. Attempting to encrypt or decrypt more data than
    the counter allows before it would overflow now raises a
    :class:`ValueError` rather than silently diverging from RFC
    7539. Setting the counter portion of the nonce to zero allows
    encrypting up to 256 GiB with a given nonce.
  * BACKWARDS INCOMPATIBLE: Loading an X.509 certificate whose
    ECDSA or DSA signature AlgorithmIdentifier contains encoded
    NULL parameters now raises a :class:`ValueError`. Such
    certificates are invalid, but older versions of Java emitted
    them; previously they loaded with a deprecation warning.
  * Fixed cross-compilation of the CFFI bindings when
    PYO3_CROSS_LIB_DIR is set. The build now derives the Python
    include directory from PYO3_CROSS_LIB_DIR instead of querying
    the host interpreter, which previously caused the build to
    fail during cross-compilations for embedded systems, on hosts
    which have same-version Python development headers installed
    as the target Python.
  * Added support for signing and verifying X.509 certificates,
    certificate signing requests, and certificate revocation
    lists with :doc:`/hazmat/primitives/asymmetric/mldsa` keys,
    as well as loading certificates that contain ML-DSA public
    keys.
  * Added
    :meth:`~cryptography.hazmat.primitives.hpke.KEM.enc_length`
    to :class:`~cryptography.hazmat.primitives.hpke.KEM` so
    callers can split the encapsulated key from the ciphertext
    returned by
    :meth:`~cryptography.hazmat.primitives.hpke.Suite.encrypt`.
  * :meth:`~cryptography.x509.verification.ExtensionPolicy.requir
    e_present`, :meth:`~cryptography.x509.verification.ExtensionP
    olicy.may_be_present`, and :meth:`~cryptography.x509.verifica
    tion.ExtensionPolicy.require_not_present` now accept any
    extension type. Previously only a fixed set of extension
    types was supported, which made it impossible to account for
    otherwise unrecognized critical extensions during path
    validation.
  * Added support for using
    :class:`~cryptography.x509.Certificate`,
    :class:`~cryptography.x509.CertificateSigningRequest`, and
    :class:`~cryptography.x509.CertificateRevocationList` as
    field types in :doc:`/hazmat/asn1/index` structures.
  * Added :func:`~cryptography.hazmat.asn1.value_set`, a class
    decorator that registers an :class:`enum.Enum` subclass as an
    ASN.1 value set: members are encoded as their underlying
    value, and decoding fails if the decoded value does not match
    one of the declared members.
  * Added :meth:`~cryptography.x509.Name.from_bytes` for parsing
    a :class:`~cryptography.x509.Name` from DER bytes, the
    inverse of :meth:`~cryptography.x509.Name.public_bytes`.
  * Added the rsa_padding keyword-only parameter to
    :meth:`~cryptography.x509.CertificateBuilder.public_key`.
    Passing the :class:`~cryptography.hazmat.primitives.asymmetri
    c.padding.PSS` class (not an instance) encodes an RSA subject
    public key in the certificate's subjectPublicKeyInfo with the
    id-RSASSA-PSS OID and no parameters.
  * Added external mu (message representative) support to
    :doc:`/hazmat/primitives/asymmetric/mldsa` via the sign_mu
    and verify_mu methods, which sign and verify a precomputed
    64-byte mu as defined in FIPS 204.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 4.0.1.</changelog>
</package>
<package pkgid="d16bb91f3c60c096707b840680d38c1a73c75e0eee0e28c765f8e7c28bbb417076da138c09b477e41166adfd550412402035dde278724ec525a97ae23883c4e3" name="python-cryptography-debuginfo" arch="x86_64">
  <version epoch="0" ver="49.0.0" rel="289.3"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1727524800">- update to 43.0.1:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.3.2.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1729598400">- update to 43.0.3:
  * Fixed release metadata for cryptography-vectors
  * Fixed compilation when using LibreSSL 4.0.0.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1730808000">- Avoid using requires_eq, which after the last modifications
  conflicts with python singlespec (order of expansion).</changelog>
  <changelog author="Ben Greiner &lt;code@bnavigator.de&gt;" date="1731067200">- Fix requires_eq replacement for distributions which do not have
  python3-cffi installed (such as SLE15 python module pythons)
  * gh#openSUSE/python-rpm-macros#185
- Remove outdated section in description</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfyhalomacro@opensuse.org&gt;" date="1737892800">- Update to version 44.0.0:
  * BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL &lt; 3.9.
  * Deprecated Python 3.7 support. Python 3.7 is no longer supported by
    the Python core team. Support for Python 3.7 will be removed in a future
    cryptography release.
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.4.0.
  * macOS wheels are now built against the macOS 10.13 SDK. Users on older
    versions of macOS should upgrade, or they will need to build cryptography
    themselves.
  * Enforce the RFC 5280 requirement that extended key usage extensions must not be empty.
  * Added support for timestamp extraction to the :class:`~cryptography.fernet.MultiFernet` class.
  * Relax the Authority Key Identifier requirements on root CA certificates
    during X.509 verification to allow fields permitted by RFC 5280 but
    forbidden by the CA/Browser BRs.
  * Added support for
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2id` when using
    OpenSSL 3.2.0+.
  * Added support for the :class:`~cryptography.x509.Admissions` certificate extension.
  * Added basic support for PKCS7 decryption (including S/MIME 3.2) via
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der`,
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_pem`,
    and :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_smime`.
- Update specfile to accommodate new project structure at version 44.0.0
- Update no-pytest_benchmark.patch</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1740571200">- update to 44.0.1:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.4.1.
  * We now build armv7l manylinux wheels and publish them to
    PyPI.
  * We now build manylinux_2_34 wheels and publish them to PyPI.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1742731200">- update to 44.0.2:
  * We now build wheels for PyPy 3.11.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1746619200">- Update to 44.0.3
  * Fixed compilation when using LibreSSL 4.1.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1752321600">- update to 45.0.5:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.1.
  * Fixed decrypting PKCS#8 files encrypted with SHA1-RC4. (This
    is not considered secure, and is supported only for backwards
    compatibility.)
  * Fixed decrypting PKCS#8 files encrypted with long salts (this
    impacts keys encrypted by Bouncy Castle).
  * Fixed decrypting PKCS#8 files encrypted with DES-CBC-MD5.
    While wildly insecure, this remains prevalent.
  * Fixed using mypy with cryptography on older versions of
    Python.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.0.
  * Support for Python 3.7 is deprecated and will be removed in
    the next cryptography release.
  * Updated the minimum supported Rust version (MSRV) to 1.74.0,
    from 1.65.0.
  * Added support for serialization of PKCS#12 Java truststores
    in :func:`~cryptography.hazmat.primitives.serialization.pkcs1
    2.serialize_java_truststore`
  * Added :meth:`~cryptography.hazmat.primitives.kdf.argon2.Argon
    2id.derive_phc_encoded` and :meth:`~cryptography.hazmat.primi
    tives.kdf.argon2.Argon2id.verify_phc_encoded` methods to
    support password hashing in the PHC string format
  * Added support for PKCS7 decryption and encryption using
    AES-256 as the content algorithm, in addition to AES-128.
  * BACKWARDS INCOMPATIBLE: Made SSH private key loading more
    consistent with other private key loading: :func:`~cryptograp
    hy.hazmat.primitives.serialization.load_ssh_private_key` now
    raises a TypeError if the key is unencrypted but a password
    is provided (previously no exception was raised), and raises
    a TypeError if the key is encrypted but no password is
    provided (previously a ValueError was raised).
  * Added __copy__ to the :class:`~cryptography.hazmat.primitives
    .asymmetric.ec.EllipticCurvePrivateKey`, :class:`~cryptograph
    y.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey`, :c
    lass:`~cryptography.hazmat.primitives.asymmetric.ed25519.Ed25
    519PublicKey`, :class:`~cryptography.hazmat.primitives.asymme
    tric.ed25519.Ed25519PrivateKey`, :class:`~cryptography.hazmat
    .primitives.asymmetric.ed448.Ed448PublicKey`, :class:`~crypto
    graphy.hazmat.primitives.asymmetric.ed448.Ed448PrivateKey`, :
    class:`~cryptography.hazmat.primitives.asymmetric.x25519.X255
    19PublicKey`, :class:`~cryptography.hazmat.primitives.asymmet
    ric.x25519.X25519PrivateKey`, :class:`~cryptography.hazmat.pr
    imitives.asymmetric.x448.X448PublicKey`, :class:`~cryptograph
    y.hazmat.primitives.asymmetric.x448.X448PrivateKey`, :class:`
    ~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey`
    , :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAP
    ublicKey`, :class:`~cryptography.hazmat.primitives.asymmetric
    .dsa.DSAPrivateKey`, :class:`~cryptography.hazmat.primitives.
    asymmetric.dsa.DSAPublicKey`, :class:`~cryptography.hazmat.pr
    imitives.asymmetric.dh.DHPrivateKey`, and :class:`~cryptograp
    hy.hazmat.primitives.asymmetric.dh.DHPublicKey` abstract base
    classes.
  * We significantly refactored how private key loading ( :func:`
    ~cryptography.hazmat.primitives.serialization.load_pem_privat
    e_key` and :func:`~cryptography.hazmat.primitives.serializati
    on.load_der_private_key`) works. This is intended to be
    backwards compatible for all well-formed keys, therefore if
    you discover a key that now raises an exception, please file
    a bug with instructions for reproducing.
  * Added unsafe_skip_rsa_key_validation keyword-argument to :fun
    c:`~cryptography.hazmat.primitives.serialization.load_ssh_pri
    vate_key`.
  * Added :class:`~cryptography.hazmat.primitives.hashes.XOFHash`
    to support repeated :meth:`~cryptography.hazmat.primitives.ha
    shes.XOFHash.squeeze` operations on extendable output
    functions.
  * Added :meth:`~cryptography.x509.ocsp.OCSPResponseBuilder.add_
    response_by_hash` method to allow creating OCSP responses
    using certificate hash values rather than full certificates.
  * Extended the :mod:`X.509 path validation
    &lt;cryptography.x509.verification&gt;` API to support user-
    configured extension policies via the
    :meth:`PolicyBuilder.extension_policies &lt;cryptography.x509.ve
    rification.PolicyBuilder.extension_policies&gt;` method.
  * Deprecated the subject, verification_time and max_chain_depth
    properties on
    :class:`~cryptography.x509.verification.ClientVerifier` and
    :class:`~cryptography.x509.verification.ServerVerifier` in
    favor of a new policy property. These properties will be
    removed in the next release of cryptography.
  * BACKWARDS INCOMPATIBLE: The :meth:`VerifiedClient.subject
    &lt;cryptography.x509.verification.VerifiedClient.subjects&gt;`
    property can now be None since a custom extension policy may
    allow certificates without a Subject Alternative Name
    extension.
  * Changed the behavior when the OpenSSL 3 legacy provider fails
    to load. Instead of raising an exception, a warning is now
    emitted. The CRYPTOGRAPHY_OPENSSL_NO_LEGACY environment
    variable can still be used to disable the legacy provider at
    runtime.
  * Added support for the CRYPTOGRAPHY_BUILD_OPENSSL_NO_LEGACY
    environment variable during build time, which prevents the
    library from ever attempting to load the legacy provider.
  * Added support for the
    :class:`~cryptography.x509.PrivateKeyUsagePeriod` X.509
    extension. This extension defines the period during which the
    private key corresponding to the certificate's public key may
    be used.
  * Added support for compiling against `aws-lc`_.
  * Parsing X.509 structures now more strictly enforces that Name
    structures do not have malformed ASN.1.
  * We now publish py311 wheels that utilize the faster
    pyo3::buffer::PyBuffer interface, resulting in significantly
    improved performance for operations involving small buffers.
  * Added :func:`~cryptography.hazmat.primitives.serialization.ss
    h_key_fingerprint` for computing fingerprints of SSH public
    keys.
  * Added support for deterministic ECDSA signing via the new
    keyword-only argument ecdsa_deterministic in
    :meth:`~cryptography.x509.CertificateBuilder.sign`, :meth:`~c
    ryptography.x509.CertificateRevocationListBuilder.sign` and :
    meth:`~cryptography.x509.CertificateSigningRequestBuilder.sig
    n`.</changelog>
  <changelog author="James Oakley &lt;jfunk@opensuse.org&gt;" date="1756728000">- Add Make-unsafe-subinterpreter-support-available-via-cfg.patch
  to allow ceph-mgr to load modules (boo#1248987)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1757851200">- update to 45.0.7:
  * Added a function to support an upcoming pyOpenSSL release.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1760356800">- update to 46.0.2:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.4.
  * Fixed an issue where users installing via pip on Python 3.14
    development versions would not properly install a dependency.
  * Fixed an issue building the free-threaded macOS 3.14 wheels.
  * BACKWARDS INCOMPATIBLE: Support for Python 3.7 has been
    removed.
  * Support for OpenSSL &lt; 3.0 is deprecated and will be removed
    in the next release.
  * Support for x86_64 macOS (including publishing wheels) is
    deprecated and will be removed in two releases. We will
    switch to publishing an arm64 only wheel for macOS.
  * Support for 32-bit Windows (including publishing wheels) is
    deprecated and will be removed in two releases. Users should
    move to a 64-bit Python installation.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.3.
  * We now build ppc64le manylinux wheels and publish them to
    PyPI.
  * We now build win_arm64 (Windows on Arm) wheels and publish
    them to PyPI.
  * Added support for free-threaded Python 3.14.
  * Removed the deprecated get_attribute_for_oid method on
    :class:`~cryptography.x509.CertificateSigningRequest`. Users
    should use
    :meth:`~cryptography.x509.Attributes.get_attribute_for_oid`
    instead.
  * Removed the deprecated CAST5, SEED, IDEA, and Blowfish
    classes from the cipher module. These are still available in
    :doc:`/hazmat/decrepit/index`.
  * In X.509, when performing a PSS signature with a SHA-3 hash,
    it is now encoded with the official NIST SHA3 OID.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1765195200">- Only require pytest-subtests with pytest &lt; 9.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1770897600">- Update to 46.0.5 (fixes CVE-2026-26007, bsc#1258074)
  * An attacker could create a malicious public key that reveals portions of
    your private key when using certain uncommon elliptic curves (binary
    curves). This version now includes additional security checks to prevent
    this attack. This issue only affects binary elliptic curves, which are
    rarely used in real-world applications. Credit to XlabAI Team of Tencent
    Xuanwu Lab and Atuin Automated Vulnerability Discovery Engine for reporting
    the issue. CVE-2026-26007
  * Support for SECT* binary elliptic curves is deprecated and will be removed
    in the next release.
- Update to 46.0.4
  * Dropped support for win_arm64 wheels.
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.5.
- Update to 46.0.3
  * Fixed compilation when using LibreSSL 4.2.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1774612800">- update to 46.0.6 (CVE-2026-34073, bsc#1260876):
  * SECURITY ISSUE: Fixed a bug where name constraints were not
    applied to peer names during verification when the leaf
    certificate contains a wildcard DNS SAN. Ordinary X.509
    topologies are not affected by this bug, including those used
    by the Web PKI. Credit to Oleh Konko (1seal) for reporting
    the issue. CVE-2026-34073</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1774958400">- Add patch support-maturin-1.12.patch:
  * Correctly deal with maturin bugfix that installs tests and
    docs under sitearch.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1775822400">- Update to 46.0.7 (fixes CVE-2026-39892, bsc#1261863)
  * **SECURITY ISSUE**: Fixed an issue where non-contiguous buffers could be
    passed to APIs that accept Python buffers, which could lead to buffer
    overflow. **CVE-2026-39892**
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.6.
- drop support-maturin-1.12.patch (upstream)
- drop no-pytest_benchmark.patch,
  Make-unsafe-subinterpreter-support-available-via-cfg.patch:
  obsolete</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1777204800">- update to 47.0.0:
  * Support for Python 3.8 is deprecated and will be removed in
    the next cryptography release.
  * BACKWARDS INCOMPATIBLE: Support for binary elliptic curves
    (SECT* classes) has been removed. These curves are rarely
    used and have additional security considerations that make
    them undesirable.
  * BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.1.x has been
    removed. OpenSSL 3.0.0 or later is now required. LibreSSL,
    BoringSSL, and AWS-LC continue to be supported.
  * BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL &lt; 4.1.
  * BACKWARDS INCOMPATIBLE: Loading keys with unsupported
    algorithms or keys with unsupported explicit curve encodings
    now raises
    :class:`~cryptography.exceptions.UnsupportedAlgorithm`
    instead of ValueError. This change affects :func:`~cryptograp
    hy.hazmat.primitives.serialization.load_pem_private_key`, :fu
    nc:`~cryptography.hazmat.primitives.serialization.load_der_pr
    ivate_key`, :func:`~cryptography.hazmat.primitives.serializat
    ion.load_pem_public_key`, :func:`~cryptography.hazmat.primiti
    ves.serialization.load_der_public_key`, and
    :meth:`~cryptography.x509.Certificate.public_key` when called
    on certificates with unsupported public key algorithms.
  * BACKWARDS INCOMPATIBLE: When parsing elliptic curve private
    keys, we now reject keys that incorrectly encode a private
    key of the wrong length because such keys are impossible to
    process in a constant-time manner. We do not believe keys
    with this problem are in wide use, however we may revert this
    change based on the feedback we receive.
  * Deprecated passing 64-bit (8-byte) and 128-bit (16-byte) keys
    to :class:`~cryptography.hazmat.decrepit.ciphers.algorithms.T
    ripleDES`. In a future release, only 192-bit (24-byte) keys
    will be accepted. Users should expand shorter keys themselves
    (e.g., for single DES: key + key + key, for two-key: key +
    key[:8]).
  * Updated the minimum supported Rust version (MSRV) to 1.83.0,
    from 1.74.0.
  * Support for x86_64 macOS (including publishing wheels) is
    deprecated and will be removed in the next release. We will
    switch to publishing an arm64 only wheel for macOS.
  * Support for 32-bit Windows (including publishing wheels) is
    deprecated and will be removed in the next release. Users
    should move to a 64-bit Python installation.
  * public_bytes and private_bytes methods on keys now raise
    TypeError (instead of ValueError) if an invalid encoding is
    provided for the given format.
  * Moved
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.CFB`,
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.OFB`, and
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.CFB8`
    into :doc:`/hazmat/decrepit/index` and deprecated them in the
    modes module. They will be removed from the modes module in
    49.0.0.
  * Moved :class:`~cryptography.hazmat.primitives.ciphers.algorit
    hms.Camellia` into  :doc:`/hazmat/decrepit/index` and
    deprecated it in the cipher module. It will be removed from
    the cipher module in 49.0.0.
  * Added
    :meth:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF.extract`
    to :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF`.
    The previous private implementation will be removed in
    49.0.0.
  * Added support for loading elliptic curve keys that contain
    explicit encodings of the curves secp256r1, secp384r1, and
    secp521r1.
  * Added support for
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2d`
    and
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2i`
    when using OpenSSL 3.2.0+.
  * Added derive_into methods to
    :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF`,
    :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDFExpand`,
    :class:`~cryptography.hazmat.primitives.kdf.concatkdf.ConcatK
    DFHash`, :class:`~cryptography.hazmat.primitives.kdf.concatkd
    f.ConcatKDFHMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2id`,
    :class:`~cryptography.hazmat.primitives.kdf.pbkdf2.PBKDF2HMAC
    `,
    :class:`~cryptography.hazmat.primitives.kdf.kbkdf.KBKDFHMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.kbkdf.KBKDFCMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.scrypt.Scrypt`,
    and
    :class:`~cryptography.hazmat.primitives.kdf.x963kdf.X963KDF`
    to allow deriving keys directly into pre-allocated buffers.
  * Added encrypt_into and decrypt_into methods to
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESCCM`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESGCM`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESGCMSI
    V`, :class:`~cryptography.hazmat.primitives.ciphers.aead.AESO
    CB3`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESSIV`,
    and :class:`~cryptography.hazmat.primitives.ciphers.aead.ChaC
    ha20Poly1305` to allow encrypting directly into a pre-
    allocated buffer.
  * Added support for PKCS1v15 signing without DigestInfo using :
    class:`~cryptography.hazmat.primitives.asymmetric.utils.NoDig
    estInfo`.
  * Added
    :meth:`~cryptography.hazmat.primitives.hashes.Hash.hash`, a
    one-shot method for computing hashes.
  * Added :doc:`/hazmat/primitives/hpke` support implementing RFC
    9180 for hybrid authenticated encryption.
  * Added new :doc:`/hazmat/primitives/asymmetric/mlkem` module
    with support for ML-KEM key encapsulation with AWS-LC and
    BoringSSL. Note: Post-quantum algorithm support requires AWS-
    LC or BoringSSL. As we ship our wheels with OpenSSL, most
    users will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Note: Post-quantum algorithm support requires AWS-LC or
    BoringSSL. As we ship our wheels with OpenSSL, most users
    will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Added new :doc:`/hazmat/primitives/asymmetric/mldsa` module
    with support for ML-DSA signing and verification with AWS-LC
    and BoringSSL. Note: Post-quantum algorithm support requires
    AWS-LC or BoringSSL. As we ship our wheels with OpenSSL, most
    users will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Note: Post-quantum algorithm support requires AWS-LC or
    BoringSSL. As we ship our wheels with OpenSSL, most users
    will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Added new :doc:`/hazmat/asn1/index` module with support for
    declaratively defining custom ASN.1 types and
    encoding/decoding them.
  * Fixed compilation when using LibreSSL 4.3.0 and OpenSSL
    4.0.0.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 4.0.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1778414400">- update to 48.0.0:
  * BACKWARDS INCOMPATIBLE: Support for Python 3.8 has been
    removed. cryptography now requires Python 3.9 or later.
  * BACKWARDS INCOMPATIBLE: Loading an X.509 CRL whose inner
    TBSCertList.signature algorithm does not match the outer
    signatureAlgorithm now raises ValueError. Previously, such
    CRLs were parsed successfully and only rejected during
    signature validation.
  * Added support for :doc:`/hazmat/primitives/asymmetric/mlkem`
    and :doc:`/hazmat/primitives/asymmetric/mldsa` when using
    OpenSSL 3.5.0 or later, in addition to the existing AWS-LC
    and BoringSSL support. This means post-quantum algorithms are
    now available to users of our wheels. Note: Going forward, we
    do not guarantee that all functionality in cryptography will
    be available when building against OpenSSL. See
    :doc:`/statements/state-of-openssl` for more information.
  * Note: Going forward, we do not guarantee that all
    functionality in cryptography will be available when building
    against OpenSSL. See :doc:`/statements/state-of-openssl` for
    more information.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1781438400">- update to 49.0.0:
  * BACKWARDS INCOMPATIBLE: Removed the deprecated
    PUBLIC_KEY_TYPES, PRIVATE_KEY_TYPES,
    CERTIFICATE_PRIVATE_KEY_TYPES,
    CERTIFICATE_ISSUER_PUBLIC_KEY_TYPES, and
    CERTIFICATE_PUBLIC_KEY_TYPES type aliases. Use
    PublicKeyTypes, PrivateKeyTypes,
    CertificateIssuerPrivateKeyTypes,
    CertificateIssuerPublicKeyTypes, and
    CertificatePublicKeyTypes instead. These were deprecated in
    version 40.0.
  * BACKWARDS INCOMPATIBLE: :class:`~cryptography.hazmat.primitiv
    es.ciphers.algorithms.ChaCha20` now treats the first 4 bytes
    of the nonce as a 32-bit little-endian block counter (as
    defined in RFC 7539) and tracks the number of bytes
    processed. Attempting to encrypt or decrypt more data than
    the counter allows before it would overflow now raises a
    :class:`ValueError` rather than silently diverging from RFC
    7539. Setting the counter portion of the nonce to zero allows
    encrypting up to 256 GiB with a given nonce.
  * BACKWARDS INCOMPATIBLE: Loading an X.509 certificate whose
    ECDSA or DSA signature AlgorithmIdentifier contains encoded
    NULL parameters now raises a :class:`ValueError`. Such
    certificates are invalid, but older versions of Java emitted
    them; previously they loaded with a deprecation warning.
  * Fixed cross-compilation of the CFFI bindings when
    PYO3_CROSS_LIB_DIR is set. The build now derives the Python
    include directory from PYO3_CROSS_LIB_DIR instead of querying
    the host interpreter, which previously caused the build to
    fail during cross-compilations for embedded systems, on hosts
    which have same-version Python development headers installed
    as the target Python.
  * Added support for signing and verifying X.509 certificates,
    certificate signing requests, and certificate revocation
    lists with :doc:`/hazmat/primitives/asymmetric/mldsa` keys,
    as well as loading certificates that contain ML-DSA public
    keys.
  * Added
    :meth:`~cryptography.hazmat.primitives.hpke.KEM.enc_length`
    to :class:`~cryptography.hazmat.primitives.hpke.KEM` so
    callers can split the encapsulated key from the ciphertext
    returned by
    :meth:`~cryptography.hazmat.primitives.hpke.Suite.encrypt`.
  * :meth:`~cryptography.x509.verification.ExtensionPolicy.requir
    e_present`, :meth:`~cryptography.x509.verification.ExtensionP
    olicy.may_be_present`, and :meth:`~cryptography.x509.verifica
    tion.ExtensionPolicy.require_not_present` now accept any
    extension type. Previously only a fixed set of extension
    types was supported, which made it impossible to account for
    otherwise unrecognized critical extensions during path
    validation.
  * Added support for using
    :class:`~cryptography.x509.Certificate`,
    :class:`~cryptography.x509.CertificateSigningRequest`, and
    :class:`~cryptography.x509.CertificateRevocationList` as
    field types in :doc:`/hazmat/asn1/index` structures.
  * Added :func:`~cryptography.hazmat.asn1.value_set`, a class
    decorator that registers an :class:`enum.Enum` subclass as an
    ASN.1 value set: members are encoded as their underlying
    value, and decoding fails if the decoded value does not match
    one of the declared members.
  * Added :meth:`~cryptography.x509.Name.from_bytes` for parsing
    a :class:`~cryptography.x509.Name` from DER bytes, the
    inverse of :meth:`~cryptography.x509.Name.public_bytes`.
  * Added the rsa_padding keyword-only parameter to
    :meth:`~cryptography.x509.CertificateBuilder.public_key`.
    Passing the :class:`~cryptography.hazmat.primitives.asymmetri
    c.padding.PSS` class (not an instance) encodes an RSA subject
    public key in the certificate's subjectPublicKeyInfo with the
    id-RSASSA-PSS OID and no parameters.
  * Added external mu (message representative) support to
    :doc:`/hazmat/primitives/asymmetric/mldsa` via the sign_mu
    and verify_mu methods, which sign and verify a precomputed
    64-byte mu as defined in FIPS 204.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 4.0.1.</changelog>
</package>
<package pkgid="31b8bd44724304bad9d658d0fe94b12cb1621f2c0ef112b1dafbbf2f09e12e4e3d4ae2b43c2948cc1464fe363d992bc0f3a90b65b5d7a0c7eb6027e5102ae718" name="python-cryptography-debugsource" arch="aarch64">
  <version epoch="0" ver="49.0.0" rel="289.3"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1727524800">- update to 43.0.1:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.3.2.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1729598400">- update to 43.0.3:
  * Fixed release metadata for cryptography-vectors
  * Fixed compilation when using LibreSSL 4.0.0.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1730808000">- Avoid using requires_eq, which after the last modifications
  conflicts with python singlespec (order of expansion).</changelog>
  <changelog author="Ben Greiner &lt;code@bnavigator.de&gt;" date="1731067200">- Fix requires_eq replacement for distributions which do not have
  python3-cffi installed (such as SLE15 python module pythons)
  * gh#openSUSE/python-rpm-macros#185
- Remove outdated section in description</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfyhalomacro@opensuse.org&gt;" date="1737892800">- Update to version 44.0.0:
  * BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL &lt; 3.9.
  * Deprecated Python 3.7 support. Python 3.7 is no longer supported by
    the Python core team. Support for Python 3.7 will be removed in a future
    cryptography release.
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.4.0.
  * macOS wheels are now built against the macOS 10.13 SDK. Users on older
    versions of macOS should upgrade, or they will need to build cryptography
    themselves.
  * Enforce the RFC 5280 requirement that extended key usage extensions must not be empty.
  * Added support for timestamp extraction to the :class:`~cryptography.fernet.MultiFernet` class.
  * Relax the Authority Key Identifier requirements on root CA certificates
    during X.509 verification to allow fields permitted by RFC 5280 but
    forbidden by the CA/Browser BRs.
  * Added support for
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2id` when using
    OpenSSL 3.2.0+.
  * Added support for the :class:`~cryptography.x509.Admissions` certificate extension.
  * Added basic support for PKCS7 decryption (including S/MIME 3.2) via
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der`,
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_pem`,
    and :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_smime`.
- Update specfile to accommodate new project structure at version 44.0.0
- Update no-pytest_benchmark.patch</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1740571200">- update to 44.0.1:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.4.1.
  * We now build armv7l manylinux wheels and publish them to
    PyPI.
  * We now build manylinux_2_34 wheels and publish them to PyPI.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1742731200">- update to 44.0.2:
  * We now build wheels for PyPy 3.11.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1746619200">- Update to 44.0.3
  * Fixed compilation when using LibreSSL 4.1.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1752321600">- update to 45.0.5:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.1.
  * Fixed decrypting PKCS#8 files encrypted with SHA1-RC4. (This
    is not considered secure, and is supported only for backwards
    compatibility.)
  * Fixed decrypting PKCS#8 files encrypted with long salts (this
    impacts keys encrypted by Bouncy Castle).
  * Fixed decrypting PKCS#8 files encrypted with DES-CBC-MD5.
    While wildly insecure, this remains prevalent.
  * Fixed using mypy with cryptography on older versions of
    Python.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.0.
  * Support for Python 3.7 is deprecated and will be removed in
    the next cryptography release.
  * Updated the minimum supported Rust version (MSRV) to 1.74.0,
    from 1.65.0.
  * Added support for serialization of PKCS#12 Java truststores
    in :func:`~cryptography.hazmat.primitives.serialization.pkcs1
    2.serialize_java_truststore`
  * Added :meth:`~cryptography.hazmat.primitives.kdf.argon2.Argon
    2id.derive_phc_encoded` and :meth:`~cryptography.hazmat.primi
    tives.kdf.argon2.Argon2id.verify_phc_encoded` methods to
    support password hashing in the PHC string format
  * Added support for PKCS7 decryption and encryption using
    AES-256 as the content algorithm, in addition to AES-128.
  * BACKWARDS INCOMPATIBLE: Made SSH private key loading more
    consistent with other private key loading: :func:`~cryptograp
    hy.hazmat.primitives.serialization.load_ssh_private_key` now
    raises a TypeError if the key is unencrypted but a password
    is provided (previously no exception was raised), and raises
    a TypeError if the key is encrypted but no password is
    provided (previously a ValueError was raised).
  * Added __copy__ to the :class:`~cryptography.hazmat.primitives
    .asymmetric.ec.EllipticCurvePrivateKey`, :class:`~cryptograph
    y.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey`, :c
    lass:`~cryptography.hazmat.primitives.asymmetric.ed25519.Ed25
    519PublicKey`, :class:`~cryptography.hazmat.primitives.asymme
    tric.ed25519.Ed25519PrivateKey`, :class:`~cryptography.hazmat
    .primitives.asymmetric.ed448.Ed448PublicKey`, :class:`~crypto
    graphy.hazmat.primitives.asymmetric.ed448.Ed448PrivateKey`, :
    class:`~cryptography.hazmat.primitives.asymmetric.x25519.X255
    19PublicKey`, :class:`~cryptography.hazmat.primitives.asymmet
    ric.x25519.X25519PrivateKey`, :class:`~cryptography.hazmat.pr
    imitives.asymmetric.x448.X448PublicKey`, :class:`~cryptograph
    y.hazmat.primitives.asymmetric.x448.X448PrivateKey`, :class:`
    ~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey`
    , :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAP
    ublicKey`, :class:`~cryptography.hazmat.primitives.asymmetric
    .dsa.DSAPrivateKey`, :class:`~cryptography.hazmat.primitives.
    asymmetric.dsa.DSAPublicKey`, :class:`~cryptography.hazmat.pr
    imitives.asymmetric.dh.DHPrivateKey`, and :class:`~cryptograp
    hy.hazmat.primitives.asymmetric.dh.DHPublicKey` abstract base
    classes.
  * We significantly refactored how private key loading ( :func:`
    ~cryptography.hazmat.primitives.serialization.load_pem_privat
    e_key` and :func:`~cryptography.hazmat.primitives.serializati
    on.load_der_private_key`) works. This is intended to be
    backwards compatible for all well-formed keys, therefore if
    you discover a key that now raises an exception, please file
    a bug with instructions for reproducing.
  * Added unsafe_skip_rsa_key_validation keyword-argument to :fun
    c:`~cryptography.hazmat.primitives.serialization.load_ssh_pri
    vate_key`.
  * Added :class:`~cryptography.hazmat.primitives.hashes.XOFHash`
    to support repeated :meth:`~cryptography.hazmat.primitives.ha
    shes.XOFHash.squeeze` operations on extendable output
    functions.
  * Added :meth:`~cryptography.x509.ocsp.OCSPResponseBuilder.add_
    response_by_hash` method to allow creating OCSP responses
    using certificate hash values rather than full certificates.
  * Extended the :mod:`X.509 path validation
    &lt;cryptography.x509.verification&gt;` API to support user-
    configured extension policies via the
    :meth:`PolicyBuilder.extension_policies &lt;cryptography.x509.ve
    rification.PolicyBuilder.extension_policies&gt;` method.
  * Deprecated the subject, verification_time and max_chain_depth
    properties on
    :class:`~cryptography.x509.verification.ClientVerifier` and
    :class:`~cryptography.x509.verification.ServerVerifier` in
    favor of a new policy property. These properties will be
    removed in the next release of cryptography.
  * BACKWARDS INCOMPATIBLE: The :meth:`VerifiedClient.subject
    &lt;cryptography.x509.verification.VerifiedClient.subjects&gt;`
    property can now be None since a custom extension policy may
    allow certificates without a Subject Alternative Name
    extension.
  * Changed the behavior when the OpenSSL 3 legacy provider fails
    to load. Instead of raising an exception, a warning is now
    emitted. The CRYPTOGRAPHY_OPENSSL_NO_LEGACY environment
    variable can still be used to disable the legacy provider at
    runtime.
  * Added support for the CRYPTOGRAPHY_BUILD_OPENSSL_NO_LEGACY
    environment variable during build time, which prevents the
    library from ever attempting to load the legacy provider.
  * Added support for the
    :class:`~cryptography.x509.PrivateKeyUsagePeriod` X.509
    extension. This extension defines the period during which the
    private key corresponding to the certificate's public key may
    be used.
  * Added support for compiling against `aws-lc`_.
  * Parsing X.509 structures now more strictly enforces that Name
    structures do not have malformed ASN.1.
  * We now publish py311 wheels that utilize the faster
    pyo3::buffer::PyBuffer interface, resulting in significantly
    improved performance for operations involving small buffers.
  * Added :func:`~cryptography.hazmat.primitives.serialization.ss
    h_key_fingerprint` for computing fingerprints of SSH public
    keys.
  * Added support for deterministic ECDSA signing via the new
    keyword-only argument ecdsa_deterministic in
    :meth:`~cryptography.x509.CertificateBuilder.sign`, :meth:`~c
    ryptography.x509.CertificateRevocationListBuilder.sign` and :
    meth:`~cryptography.x509.CertificateSigningRequestBuilder.sig
    n`.</changelog>
  <changelog author="James Oakley &lt;jfunk@opensuse.org&gt;" date="1756728000">- Add Make-unsafe-subinterpreter-support-available-via-cfg.patch
  to allow ceph-mgr to load modules (boo#1248987)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1757851200">- update to 45.0.7:
  * Added a function to support an upcoming pyOpenSSL release.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1760356800">- update to 46.0.2:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.4.
  * Fixed an issue where users installing via pip on Python 3.14
    development versions would not properly install a dependency.
  * Fixed an issue building the free-threaded macOS 3.14 wheels.
  * BACKWARDS INCOMPATIBLE: Support for Python 3.7 has been
    removed.
  * Support for OpenSSL &lt; 3.0 is deprecated and will be removed
    in the next release.
  * Support for x86_64 macOS (including publishing wheels) is
    deprecated and will be removed in two releases. We will
    switch to publishing an arm64 only wheel for macOS.
  * Support for 32-bit Windows (including publishing wheels) is
    deprecated and will be removed in two releases. Users should
    move to a 64-bit Python installation.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.3.
  * We now build ppc64le manylinux wheels and publish them to
    PyPI.
  * We now build win_arm64 (Windows on Arm) wheels and publish
    them to PyPI.
  * Added support for free-threaded Python 3.14.
  * Removed the deprecated get_attribute_for_oid method on
    :class:`~cryptography.x509.CertificateSigningRequest`. Users
    should use
    :meth:`~cryptography.x509.Attributes.get_attribute_for_oid`
    instead.
  * Removed the deprecated CAST5, SEED, IDEA, and Blowfish
    classes from the cipher module. These are still available in
    :doc:`/hazmat/decrepit/index`.
  * In X.509, when performing a PSS signature with a SHA-3 hash,
    it is now encoded with the official NIST SHA3 OID.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1765195200">- Only require pytest-subtests with pytest &lt; 9.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1770897600">- Update to 46.0.5 (fixes CVE-2026-26007, bsc#1258074)
  * An attacker could create a malicious public key that reveals portions of
    your private key when using certain uncommon elliptic curves (binary
    curves). This version now includes additional security checks to prevent
    this attack. This issue only affects binary elliptic curves, which are
    rarely used in real-world applications. Credit to XlabAI Team of Tencent
    Xuanwu Lab and Atuin Automated Vulnerability Discovery Engine for reporting
    the issue. CVE-2026-26007
  * Support for SECT* binary elliptic curves is deprecated and will be removed
    in the next release.
- Update to 46.0.4
  * Dropped support for win_arm64 wheels.
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.5.
- Update to 46.0.3
  * Fixed compilation when using LibreSSL 4.2.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1774612800">- update to 46.0.6 (CVE-2026-34073, bsc#1260876):
  * SECURITY ISSUE: Fixed a bug where name constraints were not
    applied to peer names during verification when the leaf
    certificate contains a wildcard DNS SAN. Ordinary X.509
    topologies are not affected by this bug, including those used
    by the Web PKI. Credit to Oleh Konko (1seal) for reporting
    the issue. CVE-2026-34073</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1774958400">- Add patch support-maturin-1.12.patch:
  * Correctly deal with maturin bugfix that installs tests and
    docs under sitearch.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1775822400">- Update to 46.0.7 (fixes CVE-2026-39892, bsc#1261863)
  * **SECURITY ISSUE**: Fixed an issue where non-contiguous buffers could be
    passed to APIs that accept Python buffers, which could lead to buffer
    overflow. **CVE-2026-39892**
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.6.
- drop support-maturin-1.12.patch (upstream)
- drop no-pytest_benchmark.patch,
  Make-unsafe-subinterpreter-support-available-via-cfg.patch:
  obsolete</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1777204800">- update to 47.0.0:
  * Support for Python 3.8 is deprecated and will be removed in
    the next cryptography release.
  * BACKWARDS INCOMPATIBLE: Support for binary elliptic curves
    (SECT* classes) has been removed. These curves are rarely
    used and have additional security considerations that make
    them undesirable.
  * BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.1.x has been
    removed. OpenSSL 3.0.0 or later is now required. LibreSSL,
    BoringSSL, and AWS-LC continue to be supported.
  * BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL &lt; 4.1.
  * BACKWARDS INCOMPATIBLE: Loading keys with unsupported
    algorithms or keys with unsupported explicit curve encodings
    now raises
    :class:`~cryptography.exceptions.UnsupportedAlgorithm`
    instead of ValueError. This change affects :func:`~cryptograp
    hy.hazmat.primitives.serialization.load_pem_private_key`, :fu
    nc:`~cryptography.hazmat.primitives.serialization.load_der_pr
    ivate_key`, :func:`~cryptography.hazmat.primitives.serializat
    ion.load_pem_public_key`, :func:`~cryptography.hazmat.primiti
    ves.serialization.load_der_public_key`, and
    :meth:`~cryptography.x509.Certificate.public_key` when called
    on certificates with unsupported public key algorithms.
  * BACKWARDS INCOMPATIBLE: When parsing elliptic curve private
    keys, we now reject keys that incorrectly encode a private
    key of the wrong length because such keys are impossible to
    process in a constant-time manner. We do not believe keys
    with this problem are in wide use, however we may revert this
    change based on the feedback we receive.
  * Deprecated passing 64-bit (8-byte) and 128-bit (16-byte) keys
    to :class:`~cryptography.hazmat.decrepit.ciphers.algorithms.T
    ripleDES`. In a future release, only 192-bit (24-byte) keys
    will be accepted. Users should expand shorter keys themselves
    (e.g., for single DES: key + key + key, for two-key: key +
    key[:8]).
  * Updated the minimum supported Rust version (MSRV) to 1.83.0,
    from 1.74.0.
  * Support for x86_64 macOS (including publishing wheels) is
    deprecated and will be removed in the next release. We will
    switch to publishing an arm64 only wheel for macOS.
  * Support for 32-bit Windows (including publishing wheels) is
    deprecated and will be removed in the next release. Users
    should move to a 64-bit Python installation.
  * public_bytes and private_bytes methods on keys now raise
    TypeError (instead of ValueError) if an invalid encoding is
    provided for the given format.
  * Moved
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.CFB`,
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.OFB`, and
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.CFB8`
    into :doc:`/hazmat/decrepit/index` and deprecated them in the
    modes module. They will be removed from the modes module in
    49.0.0.
  * Moved :class:`~cryptography.hazmat.primitives.ciphers.algorit
    hms.Camellia` into  :doc:`/hazmat/decrepit/index` and
    deprecated it in the cipher module. It will be removed from
    the cipher module in 49.0.0.
  * Added
    :meth:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF.extract`
    to :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF`.
    The previous private implementation will be removed in
    49.0.0.
  * Added support for loading elliptic curve keys that contain
    explicit encodings of the curves secp256r1, secp384r1, and
    secp521r1.
  * Added support for
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2d`
    and
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2i`
    when using OpenSSL 3.2.0+.
  * Added derive_into methods to
    :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF`,
    :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDFExpand`,
    :class:`~cryptography.hazmat.primitives.kdf.concatkdf.ConcatK
    DFHash`, :class:`~cryptography.hazmat.primitives.kdf.concatkd
    f.ConcatKDFHMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2id`,
    :class:`~cryptography.hazmat.primitives.kdf.pbkdf2.PBKDF2HMAC
    `,
    :class:`~cryptography.hazmat.primitives.kdf.kbkdf.KBKDFHMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.kbkdf.KBKDFCMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.scrypt.Scrypt`,
    and
    :class:`~cryptography.hazmat.primitives.kdf.x963kdf.X963KDF`
    to allow deriving keys directly into pre-allocated buffers.
  * Added encrypt_into and decrypt_into methods to
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESCCM`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESGCM`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESGCMSI
    V`, :class:`~cryptography.hazmat.primitives.ciphers.aead.AESO
    CB3`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESSIV`,
    and :class:`~cryptography.hazmat.primitives.ciphers.aead.ChaC
    ha20Poly1305` to allow encrypting directly into a pre-
    allocated buffer.
  * Added support for PKCS1v15 signing without DigestInfo using :
    class:`~cryptography.hazmat.primitives.asymmetric.utils.NoDig
    estInfo`.
  * Added
    :meth:`~cryptography.hazmat.primitives.hashes.Hash.hash`, a
    one-shot method for computing hashes.
  * Added :doc:`/hazmat/primitives/hpke` support implementing RFC
    9180 for hybrid authenticated encryption.
  * Added new :doc:`/hazmat/primitives/asymmetric/mlkem` module
    with support for ML-KEM key encapsulation with AWS-LC and
    BoringSSL. Note: Post-quantum algorithm support requires AWS-
    LC or BoringSSL. As we ship our wheels with OpenSSL, most
    users will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Note: Post-quantum algorithm support requires AWS-LC or
    BoringSSL. As we ship our wheels with OpenSSL, most users
    will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Added new :doc:`/hazmat/primitives/asymmetric/mldsa` module
    with support for ML-DSA signing and verification with AWS-LC
    and BoringSSL. Note: Post-quantum algorithm support requires
    AWS-LC or BoringSSL. As we ship our wheels with OpenSSL, most
    users will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Note: Post-quantum algorithm support requires AWS-LC or
    BoringSSL. As we ship our wheels with OpenSSL, most users
    will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Added new :doc:`/hazmat/asn1/index` module with support for
    declaratively defining custom ASN.1 types and
    encoding/decoding them.
  * Fixed compilation when using LibreSSL 4.3.0 and OpenSSL
    4.0.0.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 4.0.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1778414400">- update to 48.0.0:
  * BACKWARDS INCOMPATIBLE: Support for Python 3.8 has been
    removed. cryptography now requires Python 3.9 or later.
  * BACKWARDS INCOMPATIBLE: Loading an X.509 CRL whose inner
    TBSCertList.signature algorithm does not match the outer
    signatureAlgorithm now raises ValueError. Previously, such
    CRLs were parsed successfully and only rejected during
    signature validation.
  * Added support for :doc:`/hazmat/primitives/asymmetric/mlkem`
    and :doc:`/hazmat/primitives/asymmetric/mldsa` when using
    OpenSSL 3.5.0 or later, in addition to the existing AWS-LC
    and BoringSSL support. This means post-quantum algorithms are
    now available to users of our wheels. Note: Going forward, we
    do not guarantee that all functionality in cryptography will
    be available when building against OpenSSL. See
    :doc:`/statements/state-of-openssl` for more information.
  * Note: Going forward, we do not guarantee that all
    functionality in cryptography will be available when building
    against OpenSSL. See :doc:`/statements/state-of-openssl` for
    more information.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1781438400">- update to 49.0.0:
  * BACKWARDS INCOMPATIBLE: Removed the deprecated
    PUBLIC_KEY_TYPES, PRIVATE_KEY_TYPES,
    CERTIFICATE_PRIVATE_KEY_TYPES,
    CERTIFICATE_ISSUER_PUBLIC_KEY_TYPES, and
    CERTIFICATE_PUBLIC_KEY_TYPES type aliases. Use
    PublicKeyTypes, PrivateKeyTypes,
    CertificateIssuerPrivateKeyTypes,
    CertificateIssuerPublicKeyTypes, and
    CertificatePublicKeyTypes instead. These were deprecated in
    version 40.0.
  * BACKWARDS INCOMPATIBLE: :class:`~cryptography.hazmat.primitiv
    es.ciphers.algorithms.ChaCha20` now treats the first 4 bytes
    of the nonce as a 32-bit little-endian block counter (as
    defined in RFC 7539) and tracks the number of bytes
    processed. Attempting to encrypt or decrypt more data than
    the counter allows before it would overflow now raises a
    :class:`ValueError` rather than silently diverging from RFC
    7539. Setting the counter portion of the nonce to zero allows
    encrypting up to 256 GiB with a given nonce.
  * BACKWARDS INCOMPATIBLE: Loading an X.509 certificate whose
    ECDSA or DSA signature AlgorithmIdentifier contains encoded
    NULL parameters now raises a :class:`ValueError`. Such
    certificates are invalid, but older versions of Java emitted
    them; previously they loaded with a deprecation warning.
  * Fixed cross-compilation of the CFFI bindings when
    PYO3_CROSS_LIB_DIR is set. The build now derives the Python
    include directory from PYO3_CROSS_LIB_DIR instead of querying
    the host interpreter, which previously caused the build to
    fail during cross-compilations for embedded systems, on hosts
    which have same-version Python development headers installed
    as the target Python.
  * Added support for signing and verifying X.509 certificates,
    certificate signing requests, and certificate revocation
    lists with :doc:`/hazmat/primitives/asymmetric/mldsa` keys,
    as well as loading certificates that contain ML-DSA public
    keys.
  * Added
    :meth:`~cryptography.hazmat.primitives.hpke.KEM.enc_length`
    to :class:`~cryptography.hazmat.primitives.hpke.KEM` so
    callers can split the encapsulated key from the ciphertext
    returned by
    :meth:`~cryptography.hazmat.primitives.hpke.Suite.encrypt`.
  * :meth:`~cryptography.x509.verification.ExtensionPolicy.requir
    e_present`, :meth:`~cryptography.x509.verification.ExtensionP
    olicy.may_be_present`, and :meth:`~cryptography.x509.verifica
    tion.ExtensionPolicy.require_not_present` now accept any
    extension type. Previously only a fixed set of extension
    types was supported, which made it impossible to account for
    otherwise unrecognized critical extensions during path
    validation.
  * Added support for using
    :class:`~cryptography.x509.Certificate`,
    :class:`~cryptography.x509.CertificateSigningRequest`, and
    :class:`~cryptography.x509.CertificateRevocationList` as
    field types in :doc:`/hazmat/asn1/index` structures.
  * Added :func:`~cryptography.hazmat.asn1.value_set`, a class
    decorator that registers an :class:`enum.Enum` subclass as an
    ASN.1 value set: members are encoded as their underlying
    value, and decoding fails if the decoded value does not match
    one of the declared members.
  * Added :meth:`~cryptography.x509.Name.from_bytes` for parsing
    a :class:`~cryptography.x509.Name` from DER bytes, the
    inverse of :meth:`~cryptography.x509.Name.public_bytes`.
  * Added the rsa_padding keyword-only parameter to
    :meth:`~cryptography.x509.CertificateBuilder.public_key`.
    Passing the :class:`~cryptography.hazmat.primitives.asymmetri
    c.padding.PSS` class (not an instance) encodes an RSA subject
    public key in the certificate's subjectPublicKeyInfo with the
    id-RSASSA-PSS OID and no parameters.
  * Added external mu (message representative) support to
    :doc:`/hazmat/primitives/asymmetric/mldsa` via the sign_mu
    and verify_mu methods, which sign and verify a precomputed
    64-byte mu as defined in FIPS 204.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 4.0.1.</changelog>
</package>
<package pkgid="b43d3321a18ba4b52ecefb1817636d16d5cb51c14d38b349270fff13d678d04e9978448777d84b3c678897960e9de7f8a37ec2ae7988984bae49850d44096cf5" name="python-cryptography-debugsource" arch="armv7hl">
  <version epoch="0" ver="49.0.0" rel="289.3"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1727524800">- update to 43.0.1:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.3.2.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1729598400">- update to 43.0.3:
  * Fixed release metadata for cryptography-vectors
  * Fixed compilation when using LibreSSL 4.0.0.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1730808000">- Avoid using requires_eq, which after the last modifications
  conflicts with python singlespec (order of expansion).</changelog>
  <changelog author="Ben Greiner &lt;code@bnavigator.de&gt;" date="1731067200">- Fix requires_eq replacement for distributions which do not have
  python3-cffi installed (such as SLE15 python module pythons)
  * gh#openSUSE/python-rpm-macros#185
- Remove outdated section in description</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfyhalomacro@opensuse.org&gt;" date="1737892800">- Update to version 44.0.0:
  * BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL &lt; 3.9.
  * Deprecated Python 3.7 support. Python 3.7 is no longer supported by
    the Python core team. Support for Python 3.7 will be removed in a future
    cryptography release.
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.4.0.
  * macOS wheels are now built against the macOS 10.13 SDK. Users on older
    versions of macOS should upgrade, or they will need to build cryptography
    themselves.
  * Enforce the RFC 5280 requirement that extended key usage extensions must not be empty.
  * Added support for timestamp extraction to the :class:`~cryptography.fernet.MultiFernet` class.
  * Relax the Authority Key Identifier requirements on root CA certificates
    during X.509 verification to allow fields permitted by RFC 5280 but
    forbidden by the CA/Browser BRs.
  * Added support for
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2id` when using
    OpenSSL 3.2.0+.
  * Added support for the :class:`~cryptography.x509.Admissions` certificate extension.
  * Added basic support for PKCS7 decryption (including S/MIME 3.2) via
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der`,
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_pem`,
    and :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_smime`.
- Update specfile to accommodate new project structure at version 44.0.0
- Update no-pytest_benchmark.patch</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1740571200">- update to 44.0.1:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.4.1.
  * We now build armv7l manylinux wheels and publish them to
    PyPI.
  * We now build manylinux_2_34 wheels and publish them to PyPI.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1742731200">- update to 44.0.2:
  * We now build wheels for PyPy 3.11.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1746619200">- Update to 44.0.3
  * Fixed compilation when using LibreSSL 4.1.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1752321600">- update to 45.0.5:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.1.
  * Fixed decrypting PKCS#8 files encrypted with SHA1-RC4. (This
    is not considered secure, and is supported only for backwards
    compatibility.)
  * Fixed decrypting PKCS#8 files encrypted with long salts (this
    impacts keys encrypted by Bouncy Castle).
  * Fixed decrypting PKCS#8 files encrypted with DES-CBC-MD5.
    While wildly insecure, this remains prevalent.
  * Fixed using mypy with cryptography on older versions of
    Python.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.0.
  * Support for Python 3.7 is deprecated and will be removed in
    the next cryptography release.
  * Updated the minimum supported Rust version (MSRV) to 1.74.0,
    from 1.65.0.
  * Added support for serialization of PKCS#12 Java truststores
    in :func:`~cryptography.hazmat.primitives.serialization.pkcs1
    2.serialize_java_truststore`
  * Added :meth:`~cryptography.hazmat.primitives.kdf.argon2.Argon
    2id.derive_phc_encoded` and :meth:`~cryptography.hazmat.primi
    tives.kdf.argon2.Argon2id.verify_phc_encoded` methods to
    support password hashing in the PHC string format
  * Added support for PKCS7 decryption and encryption using
    AES-256 as the content algorithm, in addition to AES-128.
  * BACKWARDS INCOMPATIBLE: Made SSH private key loading more
    consistent with other private key loading: :func:`~cryptograp
    hy.hazmat.primitives.serialization.load_ssh_private_key` now
    raises a TypeError if the key is unencrypted but a password
    is provided (previously no exception was raised), and raises
    a TypeError if the key is encrypted but no password is
    provided (previously a ValueError was raised).
  * Added __copy__ to the :class:`~cryptography.hazmat.primitives
    .asymmetric.ec.EllipticCurvePrivateKey`, :class:`~cryptograph
    y.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey`, :c
    lass:`~cryptography.hazmat.primitives.asymmetric.ed25519.Ed25
    519PublicKey`, :class:`~cryptography.hazmat.primitives.asymme
    tric.ed25519.Ed25519PrivateKey`, :class:`~cryptography.hazmat
    .primitives.asymmetric.ed448.Ed448PublicKey`, :class:`~crypto
    graphy.hazmat.primitives.asymmetric.ed448.Ed448PrivateKey`, :
    class:`~cryptography.hazmat.primitives.asymmetric.x25519.X255
    19PublicKey`, :class:`~cryptography.hazmat.primitives.asymmet
    ric.x25519.X25519PrivateKey`, :class:`~cryptography.hazmat.pr
    imitives.asymmetric.x448.X448PublicKey`, :class:`~cryptograph
    y.hazmat.primitives.asymmetric.x448.X448PrivateKey`, :class:`
    ~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey`
    , :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAP
    ublicKey`, :class:`~cryptography.hazmat.primitives.asymmetric
    .dsa.DSAPrivateKey`, :class:`~cryptography.hazmat.primitives.
    asymmetric.dsa.DSAPublicKey`, :class:`~cryptography.hazmat.pr
    imitives.asymmetric.dh.DHPrivateKey`, and :class:`~cryptograp
    hy.hazmat.primitives.asymmetric.dh.DHPublicKey` abstract base
    classes.
  * We significantly refactored how private key loading ( :func:`
    ~cryptography.hazmat.primitives.serialization.load_pem_privat
    e_key` and :func:`~cryptography.hazmat.primitives.serializati
    on.load_der_private_key`) works. This is intended to be
    backwards compatible for all well-formed keys, therefore if
    you discover a key that now raises an exception, please file
    a bug with instructions for reproducing.
  * Added unsafe_skip_rsa_key_validation keyword-argument to :fun
    c:`~cryptography.hazmat.primitives.serialization.load_ssh_pri
    vate_key`.
  * Added :class:`~cryptography.hazmat.primitives.hashes.XOFHash`
    to support repeated :meth:`~cryptography.hazmat.primitives.ha
    shes.XOFHash.squeeze` operations on extendable output
    functions.
  * Added :meth:`~cryptography.x509.ocsp.OCSPResponseBuilder.add_
    response_by_hash` method to allow creating OCSP responses
    using certificate hash values rather than full certificates.
  * Extended the :mod:`X.509 path validation
    &lt;cryptography.x509.verification&gt;` API to support user-
    configured extension policies via the
    :meth:`PolicyBuilder.extension_policies &lt;cryptography.x509.ve
    rification.PolicyBuilder.extension_policies&gt;` method.
  * Deprecated the subject, verification_time and max_chain_depth
    properties on
    :class:`~cryptography.x509.verification.ClientVerifier` and
    :class:`~cryptography.x509.verification.ServerVerifier` in
    favor of a new policy property. These properties will be
    removed in the next release of cryptography.
  * BACKWARDS INCOMPATIBLE: The :meth:`VerifiedClient.subject
    &lt;cryptography.x509.verification.VerifiedClient.subjects&gt;`
    property can now be None since a custom extension policy may
    allow certificates without a Subject Alternative Name
    extension.
  * Changed the behavior when the OpenSSL 3 legacy provider fails
    to load. Instead of raising an exception, a warning is now
    emitted. The CRYPTOGRAPHY_OPENSSL_NO_LEGACY environment
    variable can still be used to disable the legacy provider at
    runtime.
  * Added support for the CRYPTOGRAPHY_BUILD_OPENSSL_NO_LEGACY
    environment variable during build time, which prevents the
    library from ever attempting to load the legacy provider.
  * Added support for the
    :class:`~cryptography.x509.PrivateKeyUsagePeriod` X.509
    extension. This extension defines the period during which the
    private key corresponding to the certificate's public key may
    be used.
  * Added support for compiling against `aws-lc`_.
  * Parsing X.509 structures now more strictly enforces that Name
    structures do not have malformed ASN.1.
  * We now publish py311 wheels that utilize the faster
    pyo3::buffer::PyBuffer interface, resulting in significantly
    improved performance for operations involving small buffers.
  * Added :func:`~cryptography.hazmat.primitives.serialization.ss
    h_key_fingerprint` for computing fingerprints of SSH public
    keys.
  * Added support for deterministic ECDSA signing via the new
    keyword-only argument ecdsa_deterministic in
    :meth:`~cryptography.x509.CertificateBuilder.sign`, :meth:`~c
    ryptography.x509.CertificateRevocationListBuilder.sign` and :
    meth:`~cryptography.x509.CertificateSigningRequestBuilder.sig
    n`.</changelog>
  <changelog author="James Oakley &lt;jfunk@opensuse.org&gt;" date="1756728000">- Add Make-unsafe-subinterpreter-support-available-via-cfg.patch
  to allow ceph-mgr to load modules (boo#1248987)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1757851200">- update to 45.0.7:
  * Added a function to support an upcoming pyOpenSSL release.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1760356800">- update to 46.0.2:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.4.
  * Fixed an issue where users installing via pip on Python 3.14
    development versions would not properly install a dependency.
  * Fixed an issue building the free-threaded macOS 3.14 wheels.
  * BACKWARDS INCOMPATIBLE: Support for Python 3.7 has been
    removed.
  * Support for OpenSSL &lt; 3.0 is deprecated and will be removed
    in the next release.
  * Support for x86_64 macOS (including publishing wheels) is
    deprecated and will be removed in two releases. We will
    switch to publishing an arm64 only wheel for macOS.
  * Support for 32-bit Windows (including publishing wheels) is
    deprecated and will be removed in two releases. Users should
    move to a 64-bit Python installation.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.3.
  * We now build ppc64le manylinux wheels and publish them to
    PyPI.
  * We now build win_arm64 (Windows on Arm) wheels and publish
    them to PyPI.
  * Added support for free-threaded Python 3.14.
  * Removed the deprecated get_attribute_for_oid method on
    :class:`~cryptography.x509.CertificateSigningRequest`. Users
    should use
    :meth:`~cryptography.x509.Attributes.get_attribute_for_oid`
    instead.
  * Removed the deprecated CAST5, SEED, IDEA, and Blowfish
    classes from the cipher module. These are still available in
    :doc:`/hazmat/decrepit/index`.
  * In X.509, when performing a PSS signature with a SHA-3 hash,
    it is now encoded with the official NIST SHA3 OID.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1765195200">- Only require pytest-subtests with pytest &lt; 9.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1770897600">- Update to 46.0.5 (fixes CVE-2026-26007, bsc#1258074)
  * An attacker could create a malicious public key that reveals portions of
    your private key when using certain uncommon elliptic curves (binary
    curves). This version now includes additional security checks to prevent
    this attack. This issue only affects binary elliptic curves, which are
    rarely used in real-world applications. Credit to XlabAI Team of Tencent
    Xuanwu Lab and Atuin Automated Vulnerability Discovery Engine for reporting
    the issue. CVE-2026-26007
  * Support for SECT* binary elliptic curves is deprecated and will be removed
    in the next release.
- Update to 46.0.4
  * Dropped support for win_arm64 wheels.
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.5.
- Update to 46.0.3
  * Fixed compilation when using LibreSSL 4.2.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1774612800">- update to 46.0.6 (CVE-2026-34073, bsc#1260876):
  * SECURITY ISSUE: Fixed a bug where name constraints were not
    applied to peer names during verification when the leaf
    certificate contains a wildcard DNS SAN. Ordinary X.509
    topologies are not affected by this bug, including those used
    by the Web PKI. Credit to Oleh Konko (1seal) for reporting
    the issue. CVE-2026-34073</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1774958400">- Add patch support-maturin-1.12.patch:
  * Correctly deal with maturin bugfix that installs tests and
    docs under sitearch.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1775822400">- Update to 46.0.7 (fixes CVE-2026-39892, bsc#1261863)
  * **SECURITY ISSUE**: Fixed an issue where non-contiguous buffers could be
    passed to APIs that accept Python buffers, which could lead to buffer
    overflow. **CVE-2026-39892**
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.6.
- drop support-maturin-1.12.patch (upstream)
- drop no-pytest_benchmark.patch,
  Make-unsafe-subinterpreter-support-available-via-cfg.patch:
  obsolete</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1777204800">- update to 47.0.0:
  * Support for Python 3.8 is deprecated and will be removed in
    the next cryptography release.
  * BACKWARDS INCOMPATIBLE: Support for binary elliptic curves
    (SECT* classes) has been removed. These curves are rarely
    used and have additional security considerations that make
    them undesirable.
  * BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.1.x has been
    removed. OpenSSL 3.0.0 or later is now required. LibreSSL,
    BoringSSL, and AWS-LC continue to be supported.
  * BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL &lt; 4.1.
  * BACKWARDS INCOMPATIBLE: Loading keys with unsupported
    algorithms or keys with unsupported explicit curve encodings
    now raises
    :class:`~cryptography.exceptions.UnsupportedAlgorithm`
    instead of ValueError. This change affects :func:`~cryptograp
    hy.hazmat.primitives.serialization.load_pem_private_key`, :fu
    nc:`~cryptography.hazmat.primitives.serialization.load_der_pr
    ivate_key`, :func:`~cryptography.hazmat.primitives.serializat
    ion.load_pem_public_key`, :func:`~cryptography.hazmat.primiti
    ves.serialization.load_der_public_key`, and
    :meth:`~cryptography.x509.Certificate.public_key` when called
    on certificates with unsupported public key algorithms.
  * BACKWARDS INCOMPATIBLE: When parsing elliptic curve private
    keys, we now reject keys that incorrectly encode a private
    key of the wrong length because such keys are impossible to
    process in a constant-time manner. We do not believe keys
    with this problem are in wide use, however we may revert this
    change based on the feedback we receive.
  * Deprecated passing 64-bit (8-byte) and 128-bit (16-byte) keys
    to :class:`~cryptography.hazmat.decrepit.ciphers.algorithms.T
    ripleDES`. In a future release, only 192-bit (24-byte) keys
    will be accepted. Users should expand shorter keys themselves
    (e.g., for single DES: key + key + key, for two-key: key +
    key[:8]).
  * Updated the minimum supported Rust version (MSRV) to 1.83.0,
    from 1.74.0.
  * Support for x86_64 macOS (including publishing wheels) is
    deprecated and will be removed in the next release. We will
    switch to publishing an arm64 only wheel for macOS.
  * Support for 32-bit Windows (including publishing wheels) is
    deprecated and will be removed in the next release. Users
    should move to a 64-bit Python installation.
  * public_bytes and private_bytes methods on keys now raise
    TypeError (instead of ValueError) if an invalid encoding is
    provided for the given format.
  * Moved
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.CFB`,
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.OFB`, and
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.CFB8`
    into :doc:`/hazmat/decrepit/index` and deprecated them in the
    modes module. They will be removed from the modes module in
    49.0.0.
  * Moved :class:`~cryptography.hazmat.primitives.ciphers.algorit
    hms.Camellia` into  :doc:`/hazmat/decrepit/index` and
    deprecated it in the cipher module. It will be removed from
    the cipher module in 49.0.0.
  * Added
    :meth:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF.extract`
    to :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF`.
    The previous private implementation will be removed in
    49.0.0.
  * Added support for loading elliptic curve keys that contain
    explicit encodings of the curves secp256r1, secp384r1, and
    secp521r1.
  * Added support for
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2d`
    and
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2i`
    when using OpenSSL 3.2.0+.
  * Added derive_into methods to
    :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF`,
    :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDFExpand`,
    :class:`~cryptography.hazmat.primitives.kdf.concatkdf.ConcatK
    DFHash`, :class:`~cryptography.hazmat.primitives.kdf.concatkd
    f.ConcatKDFHMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2id`,
    :class:`~cryptography.hazmat.primitives.kdf.pbkdf2.PBKDF2HMAC
    `,
    :class:`~cryptography.hazmat.primitives.kdf.kbkdf.KBKDFHMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.kbkdf.KBKDFCMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.scrypt.Scrypt`,
    and
    :class:`~cryptography.hazmat.primitives.kdf.x963kdf.X963KDF`
    to allow deriving keys directly into pre-allocated buffers.
  * Added encrypt_into and decrypt_into methods to
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESCCM`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESGCM`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESGCMSI
    V`, :class:`~cryptography.hazmat.primitives.ciphers.aead.AESO
    CB3`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESSIV`,
    and :class:`~cryptography.hazmat.primitives.ciphers.aead.ChaC
    ha20Poly1305` to allow encrypting directly into a pre-
    allocated buffer.
  * Added support for PKCS1v15 signing without DigestInfo using :
    class:`~cryptography.hazmat.primitives.asymmetric.utils.NoDig
    estInfo`.
  * Added
    :meth:`~cryptography.hazmat.primitives.hashes.Hash.hash`, a
    one-shot method for computing hashes.
  * Added :doc:`/hazmat/primitives/hpke` support implementing RFC
    9180 for hybrid authenticated encryption.
  * Added new :doc:`/hazmat/primitives/asymmetric/mlkem` module
    with support for ML-KEM key encapsulation with AWS-LC and
    BoringSSL. Note: Post-quantum algorithm support requires AWS-
    LC or BoringSSL. As we ship our wheels with OpenSSL, most
    users will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Note: Post-quantum algorithm support requires AWS-LC or
    BoringSSL. As we ship our wheels with OpenSSL, most users
    will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Added new :doc:`/hazmat/primitives/asymmetric/mldsa` module
    with support for ML-DSA signing and verification with AWS-LC
    and BoringSSL. Note: Post-quantum algorithm support requires
    AWS-LC or BoringSSL. As we ship our wheels with OpenSSL, most
    users will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Note: Post-quantum algorithm support requires AWS-LC or
    BoringSSL. As we ship our wheels with OpenSSL, most users
    will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Added new :doc:`/hazmat/asn1/index` module with support for
    declaratively defining custom ASN.1 types and
    encoding/decoding them.
  * Fixed compilation when using LibreSSL 4.3.0 and OpenSSL
    4.0.0.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 4.0.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1778414400">- update to 48.0.0:
  * BACKWARDS INCOMPATIBLE: Support for Python 3.8 has been
    removed. cryptography now requires Python 3.9 or later.
  * BACKWARDS INCOMPATIBLE: Loading an X.509 CRL whose inner
    TBSCertList.signature algorithm does not match the outer
    signatureAlgorithm now raises ValueError. Previously, such
    CRLs were parsed successfully and only rejected during
    signature validation.
  * Added support for :doc:`/hazmat/primitives/asymmetric/mlkem`
    and :doc:`/hazmat/primitives/asymmetric/mldsa` when using
    OpenSSL 3.5.0 or later, in addition to the existing AWS-LC
    and BoringSSL support. This means post-quantum algorithms are
    now available to users of our wheels. Note: Going forward, we
    do not guarantee that all functionality in cryptography will
    be available when building against OpenSSL. See
    :doc:`/statements/state-of-openssl` for more information.
  * Note: Going forward, we do not guarantee that all
    functionality in cryptography will be available when building
    against OpenSSL. See :doc:`/statements/state-of-openssl` for
    more information.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1781438400">- update to 49.0.0:
  * BACKWARDS INCOMPATIBLE: Removed the deprecated
    PUBLIC_KEY_TYPES, PRIVATE_KEY_TYPES,
    CERTIFICATE_PRIVATE_KEY_TYPES,
    CERTIFICATE_ISSUER_PUBLIC_KEY_TYPES, and
    CERTIFICATE_PUBLIC_KEY_TYPES type aliases. Use
    PublicKeyTypes, PrivateKeyTypes,
    CertificateIssuerPrivateKeyTypes,
    CertificateIssuerPublicKeyTypes, and
    CertificatePublicKeyTypes instead. These were deprecated in
    version 40.0.
  * BACKWARDS INCOMPATIBLE: :class:`~cryptography.hazmat.primitiv
    es.ciphers.algorithms.ChaCha20` now treats the first 4 bytes
    of the nonce as a 32-bit little-endian block counter (as
    defined in RFC 7539) and tracks the number of bytes
    processed. Attempting to encrypt or decrypt more data than
    the counter allows before it would overflow now raises a
    :class:`ValueError` rather than silently diverging from RFC
    7539. Setting the counter portion of the nonce to zero allows
    encrypting up to 256 GiB with a given nonce.
  * BACKWARDS INCOMPATIBLE: Loading an X.509 certificate whose
    ECDSA or DSA signature AlgorithmIdentifier contains encoded
    NULL parameters now raises a :class:`ValueError`. Such
    certificates are invalid, but older versions of Java emitted
    them; previously they loaded with a deprecation warning.
  * Fixed cross-compilation of the CFFI bindings when
    PYO3_CROSS_LIB_DIR is set. The build now derives the Python
    include directory from PYO3_CROSS_LIB_DIR instead of querying
    the host interpreter, which previously caused the build to
    fail during cross-compilations for embedded systems, on hosts
    which have same-version Python development headers installed
    as the target Python.
  * Added support for signing and verifying X.509 certificates,
    certificate signing requests, and certificate revocation
    lists with :doc:`/hazmat/primitives/asymmetric/mldsa` keys,
    as well as loading certificates that contain ML-DSA public
    keys.
  * Added
    :meth:`~cryptography.hazmat.primitives.hpke.KEM.enc_length`
    to :class:`~cryptography.hazmat.primitives.hpke.KEM` so
    callers can split the encapsulated key from the ciphertext
    returned by
    :meth:`~cryptography.hazmat.primitives.hpke.Suite.encrypt`.
  * :meth:`~cryptography.x509.verification.ExtensionPolicy.requir
    e_present`, :meth:`~cryptography.x509.verification.ExtensionP
    olicy.may_be_present`, and :meth:`~cryptography.x509.verifica
    tion.ExtensionPolicy.require_not_present` now accept any
    extension type. Previously only a fixed set of extension
    types was supported, which made it impossible to account for
    otherwise unrecognized critical extensions during path
    validation.
  * Added support for using
    :class:`~cryptography.x509.Certificate`,
    :class:`~cryptography.x509.CertificateSigningRequest`, and
    :class:`~cryptography.x509.CertificateRevocationList` as
    field types in :doc:`/hazmat/asn1/index` structures.
  * Added :func:`~cryptography.hazmat.asn1.value_set`, a class
    decorator that registers an :class:`enum.Enum` subclass as an
    ASN.1 value set: members are encoded as their underlying
    value, and decoding fails if the decoded value does not match
    one of the declared members.
  * Added :meth:`~cryptography.x509.Name.from_bytes` for parsing
    a :class:`~cryptography.x509.Name` from DER bytes, the
    inverse of :meth:`~cryptography.x509.Name.public_bytes`.
  * Added the rsa_padding keyword-only parameter to
    :meth:`~cryptography.x509.CertificateBuilder.public_key`.
    Passing the :class:`~cryptography.hazmat.primitives.asymmetri
    c.padding.PSS` class (not an instance) encodes an RSA subject
    public key in the certificate's subjectPublicKeyInfo with the
    id-RSASSA-PSS OID and no parameters.
  * Added external mu (message representative) support to
    :doc:`/hazmat/primitives/asymmetric/mldsa` via the sign_mu
    and verify_mu methods, which sign and verify a precomputed
    64-byte mu as defined in FIPS 204.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 4.0.1.</changelog>
</package>
<package pkgid="5af44bf179dd376c1e1899e64f7272516b66541fb038afa65bb4ba92d53d4b38cb0a08d4f7936b7ef12e73641ee0301ce9b4f141c07f85d69001fbf910c7d161" name="python-cryptography-debugsource" arch="x86_64">
  <version epoch="0" ver="49.0.0" rel="289.3"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1727524800">- update to 43.0.1:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.3.2.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1729598400">- update to 43.0.3:
  * Fixed release metadata for cryptography-vectors
  * Fixed compilation when using LibreSSL 4.0.0.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1730808000">- Avoid using requires_eq, which after the last modifications
  conflicts with python singlespec (order of expansion).</changelog>
  <changelog author="Ben Greiner &lt;code@bnavigator.de&gt;" date="1731067200">- Fix requires_eq replacement for distributions which do not have
  python3-cffi installed (such as SLE15 python module pythons)
  * gh#openSUSE/python-rpm-macros#185
- Remove outdated section in description</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfyhalomacro@opensuse.org&gt;" date="1737892800">- Update to version 44.0.0:
  * BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL &lt; 3.9.
  * Deprecated Python 3.7 support. Python 3.7 is no longer supported by
    the Python core team. Support for Python 3.7 will be removed in a future
    cryptography release.
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.4.0.
  * macOS wheels are now built against the macOS 10.13 SDK. Users on older
    versions of macOS should upgrade, or they will need to build cryptography
    themselves.
  * Enforce the RFC 5280 requirement that extended key usage extensions must not be empty.
  * Added support for timestamp extraction to the :class:`~cryptography.fernet.MultiFernet` class.
  * Relax the Authority Key Identifier requirements on root CA certificates
    during X.509 verification to allow fields permitted by RFC 5280 but
    forbidden by the CA/Browser BRs.
  * Added support for
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2id` when using
    OpenSSL 3.2.0+.
  * Added support for the :class:`~cryptography.x509.Admissions` certificate extension.
  * Added basic support for PKCS7 decryption (including S/MIME 3.2) via
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der`,
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_pem`,
    and :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_smime`.
- Update specfile to accommodate new project structure at version 44.0.0
- Update no-pytest_benchmark.patch</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1740571200">- update to 44.0.1:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.4.1.
  * We now build armv7l manylinux wheels and publish them to
    PyPI.
  * We now build manylinux_2_34 wheels and publish them to PyPI.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1742731200">- update to 44.0.2:
  * We now build wheels for PyPy 3.11.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1746619200">- Update to 44.0.3
  * Fixed compilation when using LibreSSL 4.1.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1752321600">- update to 45.0.5:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.1.
  * Fixed decrypting PKCS#8 files encrypted with SHA1-RC4. (This
    is not considered secure, and is supported only for backwards
    compatibility.)
  * Fixed decrypting PKCS#8 files encrypted with long salts (this
    impacts keys encrypted by Bouncy Castle).
  * Fixed decrypting PKCS#8 files encrypted with DES-CBC-MD5.
    While wildly insecure, this remains prevalent.
  * Fixed using mypy with cryptography on older versions of
    Python.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.0.
  * Support for Python 3.7 is deprecated and will be removed in
    the next cryptography release.
  * Updated the minimum supported Rust version (MSRV) to 1.74.0,
    from 1.65.0.
  * Added support for serialization of PKCS#12 Java truststores
    in :func:`~cryptography.hazmat.primitives.serialization.pkcs1
    2.serialize_java_truststore`
  * Added :meth:`~cryptography.hazmat.primitives.kdf.argon2.Argon
    2id.derive_phc_encoded` and :meth:`~cryptography.hazmat.primi
    tives.kdf.argon2.Argon2id.verify_phc_encoded` methods to
    support password hashing in the PHC string format
  * Added support for PKCS7 decryption and encryption using
    AES-256 as the content algorithm, in addition to AES-128.
  * BACKWARDS INCOMPATIBLE: Made SSH private key loading more
    consistent with other private key loading: :func:`~cryptograp
    hy.hazmat.primitives.serialization.load_ssh_private_key` now
    raises a TypeError if the key is unencrypted but a password
    is provided (previously no exception was raised), and raises
    a TypeError if the key is encrypted but no password is
    provided (previously a ValueError was raised).
  * Added __copy__ to the :class:`~cryptography.hazmat.primitives
    .asymmetric.ec.EllipticCurvePrivateKey`, :class:`~cryptograph
    y.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey`, :c
    lass:`~cryptography.hazmat.primitives.asymmetric.ed25519.Ed25
    519PublicKey`, :class:`~cryptography.hazmat.primitives.asymme
    tric.ed25519.Ed25519PrivateKey`, :class:`~cryptography.hazmat
    .primitives.asymmetric.ed448.Ed448PublicKey`, :class:`~crypto
    graphy.hazmat.primitives.asymmetric.ed448.Ed448PrivateKey`, :
    class:`~cryptography.hazmat.primitives.asymmetric.x25519.X255
    19PublicKey`, :class:`~cryptography.hazmat.primitives.asymmet
    ric.x25519.X25519PrivateKey`, :class:`~cryptography.hazmat.pr
    imitives.asymmetric.x448.X448PublicKey`, :class:`~cryptograph
    y.hazmat.primitives.asymmetric.x448.X448PrivateKey`, :class:`
    ~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey`
    , :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAP
    ublicKey`, :class:`~cryptography.hazmat.primitives.asymmetric
    .dsa.DSAPrivateKey`, :class:`~cryptography.hazmat.primitives.
    asymmetric.dsa.DSAPublicKey`, :class:`~cryptography.hazmat.pr
    imitives.asymmetric.dh.DHPrivateKey`, and :class:`~cryptograp
    hy.hazmat.primitives.asymmetric.dh.DHPublicKey` abstract base
    classes.
  * We significantly refactored how private key loading ( :func:`
    ~cryptography.hazmat.primitives.serialization.load_pem_privat
    e_key` and :func:`~cryptography.hazmat.primitives.serializati
    on.load_der_private_key`) works. This is intended to be
    backwards compatible for all well-formed keys, therefore if
    you discover a key that now raises an exception, please file
    a bug with instructions for reproducing.
  * Added unsafe_skip_rsa_key_validation keyword-argument to :fun
    c:`~cryptography.hazmat.primitives.serialization.load_ssh_pri
    vate_key`.
  * Added :class:`~cryptography.hazmat.primitives.hashes.XOFHash`
    to support repeated :meth:`~cryptography.hazmat.primitives.ha
    shes.XOFHash.squeeze` operations on extendable output
    functions.
  * Added :meth:`~cryptography.x509.ocsp.OCSPResponseBuilder.add_
    response_by_hash` method to allow creating OCSP responses
    using certificate hash values rather than full certificates.
  * Extended the :mod:`X.509 path validation
    &lt;cryptography.x509.verification&gt;` API to support user-
    configured extension policies via the
    :meth:`PolicyBuilder.extension_policies &lt;cryptography.x509.ve
    rification.PolicyBuilder.extension_policies&gt;` method.
  * Deprecated the subject, verification_time and max_chain_depth
    properties on
    :class:`~cryptography.x509.verification.ClientVerifier` and
    :class:`~cryptography.x509.verification.ServerVerifier` in
    favor of a new policy property. These properties will be
    removed in the next release of cryptography.
  * BACKWARDS INCOMPATIBLE: The :meth:`VerifiedClient.subject
    &lt;cryptography.x509.verification.VerifiedClient.subjects&gt;`
    property can now be None since a custom extension policy may
    allow certificates without a Subject Alternative Name
    extension.
  * Changed the behavior when the OpenSSL 3 legacy provider fails
    to load. Instead of raising an exception, a warning is now
    emitted. The CRYPTOGRAPHY_OPENSSL_NO_LEGACY environment
    variable can still be used to disable the legacy provider at
    runtime.
  * Added support for the CRYPTOGRAPHY_BUILD_OPENSSL_NO_LEGACY
    environment variable during build time, which prevents the
    library from ever attempting to load the legacy provider.
  * Added support for the
    :class:`~cryptography.x509.PrivateKeyUsagePeriod` X.509
    extension. This extension defines the period during which the
    private key corresponding to the certificate's public key may
    be used.
  * Added support for compiling against `aws-lc`_.
  * Parsing X.509 structures now more strictly enforces that Name
    structures do not have malformed ASN.1.
  * We now publish py311 wheels that utilize the faster
    pyo3::buffer::PyBuffer interface, resulting in significantly
    improved performance for operations involving small buffers.
  * Added :func:`~cryptography.hazmat.primitives.serialization.ss
    h_key_fingerprint` for computing fingerprints of SSH public
    keys.
  * Added support for deterministic ECDSA signing via the new
    keyword-only argument ecdsa_deterministic in
    :meth:`~cryptography.x509.CertificateBuilder.sign`, :meth:`~c
    ryptography.x509.CertificateRevocationListBuilder.sign` and :
    meth:`~cryptography.x509.CertificateSigningRequestBuilder.sig
    n`.</changelog>
  <changelog author="James Oakley &lt;jfunk@opensuse.org&gt;" date="1756728000">- Add Make-unsafe-subinterpreter-support-available-via-cfg.patch
  to allow ceph-mgr to load modules (boo#1248987)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1757851200">- update to 45.0.7:
  * Added a function to support an upcoming pyOpenSSL release.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1760356800">- update to 46.0.2:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.4.
  * Fixed an issue where users installing via pip on Python 3.14
    development versions would not properly install a dependency.
  * Fixed an issue building the free-threaded macOS 3.14 wheels.
  * BACKWARDS INCOMPATIBLE: Support for Python 3.7 has been
    removed.
  * Support for OpenSSL &lt; 3.0 is deprecated and will be removed
    in the next release.
  * Support for x86_64 macOS (including publishing wheels) is
    deprecated and will be removed in two releases. We will
    switch to publishing an arm64 only wheel for macOS.
  * Support for 32-bit Windows (including publishing wheels) is
    deprecated and will be removed in two releases. Users should
    move to a 64-bit Python installation.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.3.
  * We now build ppc64le manylinux wheels and publish them to
    PyPI.
  * We now build win_arm64 (Windows on Arm) wheels and publish
    them to PyPI.
  * Added support for free-threaded Python 3.14.
  * Removed the deprecated get_attribute_for_oid method on
    :class:`~cryptography.x509.CertificateSigningRequest`. Users
    should use
    :meth:`~cryptography.x509.Attributes.get_attribute_for_oid`
    instead.
  * Removed the deprecated CAST5, SEED, IDEA, and Blowfish
    classes from the cipher module. These are still available in
    :doc:`/hazmat/decrepit/index`.
  * In X.509, when performing a PSS signature with a SHA-3 hash,
    it is now encoded with the official NIST SHA3 OID.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1765195200">- Only require pytest-subtests with pytest &lt; 9.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1770897600">- Update to 46.0.5 (fixes CVE-2026-26007, bsc#1258074)
  * An attacker could create a malicious public key that reveals portions of
    your private key when using certain uncommon elliptic curves (binary
    curves). This version now includes additional security checks to prevent
    this attack. This issue only affects binary elliptic curves, which are
    rarely used in real-world applications. Credit to XlabAI Team of Tencent
    Xuanwu Lab and Atuin Automated Vulnerability Discovery Engine for reporting
    the issue. CVE-2026-26007
  * Support for SECT* binary elliptic curves is deprecated and will be removed
    in the next release.
- Update to 46.0.4
  * Dropped support for win_arm64 wheels.
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.5.
- Update to 46.0.3
  * Fixed compilation when using LibreSSL 4.2.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1774612800">- update to 46.0.6 (CVE-2026-34073, bsc#1260876):
  * SECURITY ISSUE: Fixed a bug where name constraints were not
    applied to peer names during verification when the leaf
    certificate contains a wildcard DNS SAN. Ordinary X.509
    topologies are not affected by this bug, including those used
    by the Web PKI. Credit to Oleh Konko (1seal) for reporting
    the issue. CVE-2026-34073</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1774958400">- Add patch support-maturin-1.12.patch:
  * Correctly deal with maturin bugfix that installs tests and
    docs under sitearch.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1775822400">- Update to 46.0.7 (fixes CVE-2026-39892, bsc#1261863)
  * **SECURITY ISSUE**: Fixed an issue where non-contiguous buffers could be
    passed to APIs that accept Python buffers, which could lead to buffer
    overflow. **CVE-2026-39892**
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.6.
- drop support-maturin-1.12.patch (upstream)
- drop no-pytest_benchmark.patch,
  Make-unsafe-subinterpreter-support-available-via-cfg.patch:
  obsolete</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1777204800">- update to 47.0.0:
  * Support for Python 3.8 is deprecated and will be removed in
    the next cryptography release.
  * BACKWARDS INCOMPATIBLE: Support for binary elliptic curves
    (SECT* classes) has been removed. These curves are rarely
    used and have additional security considerations that make
    them undesirable.
  * BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.1.x has been
    removed. OpenSSL 3.0.0 or later is now required. LibreSSL,
    BoringSSL, and AWS-LC continue to be supported.
  * BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL &lt; 4.1.
  * BACKWARDS INCOMPATIBLE: Loading keys with unsupported
    algorithms or keys with unsupported explicit curve encodings
    now raises
    :class:`~cryptography.exceptions.UnsupportedAlgorithm`
    instead of ValueError. This change affects :func:`~cryptograp
    hy.hazmat.primitives.serialization.load_pem_private_key`, :fu
    nc:`~cryptography.hazmat.primitives.serialization.load_der_pr
    ivate_key`, :func:`~cryptography.hazmat.primitives.serializat
    ion.load_pem_public_key`, :func:`~cryptography.hazmat.primiti
    ves.serialization.load_der_public_key`, and
    :meth:`~cryptography.x509.Certificate.public_key` when called
    on certificates with unsupported public key algorithms.
  * BACKWARDS INCOMPATIBLE: When parsing elliptic curve private
    keys, we now reject keys that incorrectly encode a private
    key of the wrong length because such keys are impossible to
    process in a constant-time manner. We do not believe keys
    with this problem are in wide use, however we may revert this
    change based on the feedback we receive.
  * Deprecated passing 64-bit (8-byte) and 128-bit (16-byte) keys
    to :class:`~cryptography.hazmat.decrepit.ciphers.algorithms.T
    ripleDES`. In a future release, only 192-bit (24-byte) keys
    will be accepted. Users should expand shorter keys themselves
    (e.g., for single DES: key + key + key, for two-key: key +
    key[:8]).
  * Updated the minimum supported Rust version (MSRV) to 1.83.0,
    from 1.74.0.
  * Support for x86_64 macOS (including publishing wheels) is
    deprecated and will be removed in the next release. We will
    switch to publishing an arm64 only wheel for macOS.
  * Support for 32-bit Windows (including publishing wheels) is
    deprecated and will be removed in the next release. Users
    should move to a 64-bit Python installation.
  * public_bytes and private_bytes methods on keys now raise
    TypeError (instead of ValueError) if an invalid encoding is
    provided for the given format.
  * Moved
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.CFB`,
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.OFB`, and
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.CFB8`
    into :doc:`/hazmat/decrepit/index` and deprecated them in the
    modes module. They will be removed from the modes module in
    49.0.0.
  * Moved :class:`~cryptography.hazmat.primitives.ciphers.algorit
    hms.Camellia` into  :doc:`/hazmat/decrepit/index` and
    deprecated it in the cipher module. It will be removed from
    the cipher module in 49.0.0.
  * Added
    :meth:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF.extract`
    to :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF`.
    The previous private implementation will be removed in
    49.0.0.
  * Added support for loading elliptic curve keys that contain
    explicit encodings of the curves secp256r1, secp384r1, and
    secp521r1.
  * Added support for
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2d`
    and
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2i`
    when using OpenSSL 3.2.0+.
  * Added derive_into methods to
    :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF`,
    :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDFExpand`,
    :class:`~cryptography.hazmat.primitives.kdf.concatkdf.ConcatK
    DFHash`, :class:`~cryptography.hazmat.primitives.kdf.concatkd
    f.ConcatKDFHMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2id`,
    :class:`~cryptography.hazmat.primitives.kdf.pbkdf2.PBKDF2HMAC
    `,
    :class:`~cryptography.hazmat.primitives.kdf.kbkdf.KBKDFHMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.kbkdf.KBKDFCMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.scrypt.Scrypt`,
    and
    :class:`~cryptography.hazmat.primitives.kdf.x963kdf.X963KDF`
    to allow deriving keys directly into pre-allocated buffers.
  * Added encrypt_into and decrypt_into methods to
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESCCM`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESGCM`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESGCMSI
    V`, :class:`~cryptography.hazmat.primitives.ciphers.aead.AESO
    CB3`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESSIV`,
    and :class:`~cryptography.hazmat.primitives.ciphers.aead.ChaC
    ha20Poly1305` to allow encrypting directly into a pre-
    allocated buffer.
  * Added support for PKCS1v15 signing without DigestInfo using :
    class:`~cryptography.hazmat.primitives.asymmetric.utils.NoDig
    estInfo`.
  * Added
    :meth:`~cryptography.hazmat.primitives.hashes.Hash.hash`, a
    one-shot method for computing hashes.
  * Added :doc:`/hazmat/primitives/hpke` support implementing RFC
    9180 for hybrid authenticated encryption.
  * Added new :doc:`/hazmat/primitives/asymmetric/mlkem` module
    with support for ML-KEM key encapsulation with AWS-LC and
    BoringSSL. Note: Post-quantum algorithm support requires AWS-
    LC or BoringSSL. As we ship our wheels with OpenSSL, most
    users will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Note: Post-quantum algorithm support requires AWS-LC or
    BoringSSL. As we ship our wheels with OpenSSL, most users
    will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Added new :doc:`/hazmat/primitives/asymmetric/mldsa` module
    with support for ML-DSA signing and verification with AWS-LC
    and BoringSSL. Note: Post-quantum algorithm support requires
    AWS-LC or BoringSSL. As we ship our wheels with OpenSSL, most
    users will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Note: Post-quantum algorithm support requires AWS-LC or
    BoringSSL. As we ship our wheels with OpenSSL, most users
    will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Added new :doc:`/hazmat/asn1/index` module with support for
    declaratively defining custom ASN.1 types and
    encoding/decoding them.
  * Fixed compilation when using LibreSSL 4.3.0 and OpenSSL
    4.0.0.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 4.0.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1778414400">- update to 48.0.0:
  * BACKWARDS INCOMPATIBLE: Support for Python 3.8 has been
    removed. cryptography now requires Python 3.9 or later.
  * BACKWARDS INCOMPATIBLE: Loading an X.509 CRL whose inner
    TBSCertList.signature algorithm does not match the outer
    signatureAlgorithm now raises ValueError. Previously, such
    CRLs were parsed successfully and only rejected during
    signature validation.
  * Added support for :doc:`/hazmat/primitives/asymmetric/mlkem`
    and :doc:`/hazmat/primitives/asymmetric/mldsa` when using
    OpenSSL 3.5.0 or later, in addition to the existing AWS-LC
    and BoringSSL support. This means post-quantum algorithms are
    now available to users of our wheels. Note: Going forward, we
    do not guarantee that all functionality in cryptography will
    be available when building against OpenSSL. See
    :doc:`/statements/state-of-openssl` for more information.
  * Note: Going forward, we do not guarantee that all
    functionality in cryptography will be available when building
    against OpenSSL. See :doc:`/statements/state-of-openssl` for
    more information.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1781438400">- update to 49.0.0:
  * BACKWARDS INCOMPATIBLE: Removed the deprecated
    PUBLIC_KEY_TYPES, PRIVATE_KEY_TYPES,
    CERTIFICATE_PRIVATE_KEY_TYPES,
    CERTIFICATE_ISSUER_PUBLIC_KEY_TYPES, and
    CERTIFICATE_PUBLIC_KEY_TYPES type aliases. Use
    PublicKeyTypes, PrivateKeyTypes,
    CertificateIssuerPrivateKeyTypes,
    CertificateIssuerPublicKeyTypes, and
    CertificatePublicKeyTypes instead. These were deprecated in
    version 40.0.
  * BACKWARDS INCOMPATIBLE: :class:`~cryptography.hazmat.primitiv
    es.ciphers.algorithms.ChaCha20` now treats the first 4 bytes
    of the nonce as a 32-bit little-endian block counter (as
    defined in RFC 7539) and tracks the number of bytes
    processed. Attempting to encrypt or decrypt more data than
    the counter allows before it would overflow now raises a
    :class:`ValueError` rather than silently diverging from RFC
    7539. Setting the counter portion of the nonce to zero allows
    encrypting up to 256 GiB with a given nonce.
  * BACKWARDS INCOMPATIBLE: Loading an X.509 certificate whose
    ECDSA or DSA signature AlgorithmIdentifier contains encoded
    NULL parameters now raises a :class:`ValueError`. Such
    certificates are invalid, but older versions of Java emitted
    them; previously they loaded with a deprecation warning.
  * Fixed cross-compilation of the CFFI bindings when
    PYO3_CROSS_LIB_DIR is set. The build now derives the Python
    include directory from PYO3_CROSS_LIB_DIR instead of querying
    the host interpreter, which previously caused the build to
    fail during cross-compilations for embedded systems, on hosts
    which have same-version Python development headers installed
    as the target Python.
  * Added support for signing and verifying X.509 certificates,
    certificate signing requests, and certificate revocation
    lists with :doc:`/hazmat/primitives/asymmetric/mldsa` keys,
    as well as loading certificates that contain ML-DSA public
    keys.
  * Added
    :meth:`~cryptography.hazmat.primitives.hpke.KEM.enc_length`
    to :class:`~cryptography.hazmat.primitives.hpke.KEM` so
    callers can split the encapsulated key from the ciphertext
    returned by
    :meth:`~cryptography.hazmat.primitives.hpke.Suite.encrypt`.
  * :meth:`~cryptography.x509.verification.ExtensionPolicy.requir
    e_present`, :meth:`~cryptography.x509.verification.ExtensionP
    olicy.may_be_present`, and :meth:`~cryptography.x509.verifica
    tion.ExtensionPolicy.require_not_present` now accept any
    extension type. Previously only a fixed set of extension
    types was supported, which made it impossible to account for
    otherwise unrecognized critical extensions during path
    validation.
  * Added support for using
    :class:`~cryptography.x509.Certificate`,
    :class:`~cryptography.x509.CertificateSigningRequest`, and
    :class:`~cryptography.x509.CertificateRevocationList` as
    field types in :doc:`/hazmat/asn1/index` structures.
  * Added :func:`~cryptography.hazmat.asn1.value_set`, a class
    decorator that registers an :class:`enum.Enum` subclass as an
    ASN.1 value set: members are encoded as their underlying
    value, and decoding fails if the decoded value does not match
    one of the declared members.
  * Added :meth:`~cryptography.x509.Name.from_bytes` for parsing
    a :class:`~cryptography.x509.Name` from DER bytes, the
    inverse of :meth:`~cryptography.x509.Name.public_bytes`.
  * Added the rsa_padding keyword-only parameter to
    :meth:`~cryptography.x509.CertificateBuilder.public_key`.
    Passing the :class:`~cryptography.hazmat.primitives.asymmetri
    c.padding.PSS` class (not an instance) encodes an RSA subject
    public key in the certificate's subjectPublicKeyInfo with the
    id-RSASSA-PSS OID and no parameters.
  * Added external mu (message representative) support to
    :doc:`/hazmat/primitives/asymmetric/mldsa` via the sign_mu
    and verify_mu methods, which sign and verify a precomputed
    64-byte mu as defined in FIPS 204.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 4.0.1.</changelog>
</package>
<package pkgid="6b160a379ca2e7ac34ba91f49ebc87e8401b92e624aa5310233aeee5ca8243275935255a265d1a0ca06847899a3697fc52874acba1eae9a4137a83b231507eb2" name="python-cryptography-test" arch="src">
  <version epoch="0" ver="49.0.0" rel="289.5"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1727524800">- update to 43.0.1:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.3.2.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1729598400">- update to 43.0.3:
  * Fixed release metadata for cryptography-vectors
  * Fixed compilation when using LibreSSL 4.0.0.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1730808000">- Avoid using requires_eq, which after the last modifications
  conflicts with python singlespec (order of expansion).</changelog>
  <changelog author="Ben Greiner &lt;code@bnavigator.de&gt;" date="1731067200">- Fix requires_eq replacement for distributions which do not have
  python3-cffi installed (such as SLE15 python module pythons)
  * gh#openSUSE/python-rpm-macros#185
- Remove outdated section in description</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfyhalomacro@opensuse.org&gt;" date="1737892800">- Update to version 44.0.0:
  * BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL &lt; 3.9.
  * Deprecated Python 3.7 support. Python 3.7 is no longer supported by
    the Python core team. Support for Python 3.7 will be removed in a future
    cryptography release.
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.4.0.
  * macOS wheels are now built against the macOS 10.13 SDK. Users on older
    versions of macOS should upgrade, or they will need to build cryptography
    themselves.
  * Enforce the RFC 5280 requirement that extended key usage extensions must not be empty.
  * Added support for timestamp extraction to the :class:`~cryptography.fernet.MultiFernet` class.
  * Relax the Authority Key Identifier requirements on root CA certificates
    during X.509 verification to allow fields permitted by RFC 5280 but
    forbidden by the CA/Browser BRs.
  * Added support for
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2id` when using
    OpenSSL 3.2.0+.
  * Added support for the :class:`~cryptography.x509.Admissions` certificate extension.
  * Added basic support for PKCS7 decryption (including S/MIME 3.2) via
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der`,
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_pem`,
    and :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_smime`.
- Update specfile to accommodate new project structure at version 44.0.0
- Update no-pytest_benchmark.patch</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1740571200">- update to 44.0.1:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.4.1.
  * We now build armv7l manylinux wheels and publish them to
    PyPI.
  * We now build manylinux_2_34 wheels and publish them to PyPI.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1742731200">- update to 44.0.2:
  * We now build wheels for PyPy 3.11.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1746619200">- Update to 44.0.3
  * Fixed compilation when using LibreSSL 4.1.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1752321600">- update to 45.0.5:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.1.
  * Fixed decrypting PKCS#8 files encrypted with SHA1-RC4. (This
    is not considered secure, and is supported only for backwards
    compatibility.)
  * Fixed decrypting PKCS#8 files encrypted with long salts (this
    impacts keys encrypted by Bouncy Castle).
  * Fixed decrypting PKCS#8 files encrypted with DES-CBC-MD5.
    While wildly insecure, this remains prevalent.
  * Fixed using mypy with cryptography on older versions of
    Python.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.0.
  * Support for Python 3.7 is deprecated and will be removed in
    the next cryptography release.
  * Updated the minimum supported Rust version (MSRV) to 1.74.0,
    from 1.65.0.
  * Added support for serialization of PKCS#12 Java truststores
    in :func:`~cryptography.hazmat.primitives.serialization.pkcs1
    2.serialize_java_truststore`
  * Added :meth:`~cryptography.hazmat.primitives.kdf.argon2.Argon
    2id.derive_phc_encoded` and :meth:`~cryptography.hazmat.primi
    tives.kdf.argon2.Argon2id.verify_phc_encoded` methods to
    support password hashing in the PHC string format
  * Added support for PKCS7 decryption and encryption using
    AES-256 as the content algorithm, in addition to AES-128.
  * BACKWARDS INCOMPATIBLE: Made SSH private key loading more
    consistent with other private key loading: :func:`~cryptograp
    hy.hazmat.primitives.serialization.load_ssh_private_key` now
    raises a TypeError if the key is unencrypted but a password
    is provided (previously no exception was raised), and raises
    a TypeError if the key is encrypted but no password is
    provided (previously a ValueError was raised).
  * Added __copy__ to the :class:`~cryptography.hazmat.primitives
    .asymmetric.ec.EllipticCurvePrivateKey`, :class:`~cryptograph
    y.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey`, :c
    lass:`~cryptography.hazmat.primitives.asymmetric.ed25519.Ed25
    519PublicKey`, :class:`~cryptography.hazmat.primitives.asymme
    tric.ed25519.Ed25519PrivateKey`, :class:`~cryptography.hazmat
    .primitives.asymmetric.ed448.Ed448PublicKey`, :class:`~crypto
    graphy.hazmat.primitives.asymmetric.ed448.Ed448PrivateKey`, :
    class:`~cryptography.hazmat.primitives.asymmetric.x25519.X255
    19PublicKey`, :class:`~cryptography.hazmat.primitives.asymmet
    ric.x25519.X25519PrivateKey`, :class:`~cryptography.hazmat.pr
    imitives.asymmetric.x448.X448PublicKey`, :class:`~cryptograph
    y.hazmat.primitives.asymmetric.x448.X448PrivateKey`, :class:`
    ~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey`
    , :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAP
    ublicKey`, :class:`~cryptography.hazmat.primitives.asymmetric
    .dsa.DSAPrivateKey`, :class:`~cryptography.hazmat.primitives.
    asymmetric.dsa.DSAPublicKey`, :class:`~cryptography.hazmat.pr
    imitives.asymmetric.dh.DHPrivateKey`, and :class:`~cryptograp
    hy.hazmat.primitives.asymmetric.dh.DHPublicKey` abstract base
    classes.
  * We significantly refactored how private key loading ( :func:`
    ~cryptography.hazmat.primitives.serialization.load_pem_privat
    e_key` and :func:`~cryptography.hazmat.primitives.serializati
    on.load_der_private_key`) works. This is intended to be
    backwards compatible for all well-formed keys, therefore if
    you discover a key that now raises an exception, please file
    a bug with instructions for reproducing.
  * Added unsafe_skip_rsa_key_validation keyword-argument to :fun
    c:`~cryptography.hazmat.primitives.serialization.load_ssh_pri
    vate_key`.
  * Added :class:`~cryptography.hazmat.primitives.hashes.XOFHash`
    to support repeated :meth:`~cryptography.hazmat.primitives.ha
    shes.XOFHash.squeeze` operations on extendable output
    functions.
  * Added :meth:`~cryptography.x509.ocsp.OCSPResponseBuilder.add_
    response_by_hash` method to allow creating OCSP responses
    using certificate hash values rather than full certificates.
  * Extended the :mod:`X.509 path validation
    &lt;cryptography.x509.verification&gt;` API to support user-
    configured extension policies via the
    :meth:`PolicyBuilder.extension_policies &lt;cryptography.x509.ve
    rification.PolicyBuilder.extension_policies&gt;` method.
  * Deprecated the subject, verification_time and max_chain_depth
    properties on
    :class:`~cryptography.x509.verification.ClientVerifier` and
    :class:`~cryptography.x509.verification.ServerVerifier` in
    favor of a new policy property. These properties will be
    removed in the next release of cryptography.
  * BACKWARDS INCOMPATIBLE: The :meth:`VerifiedClient.subject
    &lt;cryptography.x509.verification.VerifiedClient.subjects&gt;`
    property can now be None since a custom extension policy may
    allow certificates without a Subject Alternative Name
    extension.
  * Changed the behavior when the OpenSSL 3 legacy provider fails
    to load. Instead of raising an exception, a warning is now
    emitted. The CRYPTOGRAPHY_OPENSSL_NO_LEGACY environment
    variable can still be used to disable the legacy provider at
    runtime.
  * Added support for the CRYPTOGRAPHY_BUILD_OPENSSL_NO_LEGACY
    environment variable during build time, which prevents the
    library from ever attempting to load the legacy provider.
  * Added support for the
    :class:`~cryptography.x509.PrivateKeyUsagePeriod` X.509
    extension. This extension defines the period during which the
    private key corresponding to the certificate's public key may
    be used.
  * Added support for compiling against `aws-lc`_.
  * Parsing X.509 structures now more strictly enforces that Name
    structures do not have malformed ASN.1.
  * We now publish py311 wheels that utilize the faster
    pyo3::buffer::PyBuffer interface, resulting in significantly
    improved performance for operations involving small buffers.
  * Added :func:`~cryptography.hazmat.primitives.serialization.ss
    h_key_fingerprint` for computing fingerprints of SSH public
    keys.
  * Added support for deterministic ECDSA signing via the new
    keyword-only argument ecdsa_deterministic in
    :meth:`~cryptography.x509.CertificateBuilder.sign`, :meth:`~c
    ryptography.x509.CertificateRevocationListBuilder.sign` and :
    meth:`~cryptography.x509.CertificateSigningRequestBuilder.sig
    n`.</changelog>
  <changelog author="James Oakley &lt;jfunk@opensuse.org&gt;" date="1756728000">- Add Make-unsafe-subinterpreter-support-available-via-cfg.patch
  to allow ceph-mgr to load modules (boo#1248987)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1757851200">- update to 45.0.7:
  * Added a function to support an upcoming pyOpenSSL release.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1760356800">- update to 46.0.2:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.4.
  * Fixed an issue where users installing via pip on Python 3.14
    development versions would not properly install a dependency.
  * Fixed an issue building the free-threaded macOS 3.14 wheels.
  * BACKWARDS INCOMPATIBLE: Support for Python 3.7 has been
    removed.
  * Support for OpenSSL &lt; 3.0 is deprecated and will be removed
    in the next release.
  * Support for x86_64 macOS (including publishing wheels) is
    deprecated and will be removed in two releases. We will
    switch to publishing an arm64 only wheel for macOS.
  * Support for 32-bit Windows (including publishing wheels) is
    deprecated and will be removed in two releases. Users should
    move to a 64-bit Python installation.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.3.
  * We now build ppc64le manylinux wheels and publish them to
    PyPI.
  * We now build win_arm64 (Windows on Arm) wheels and publish
    them to PyPI.
  * Added support for free-threaded Python 3.14.
  * Removed the deprecated get_attribute_for_oid method on
    :class:`~cryptography.x509.CertificateSigningRequest`. Users
    should use
    :meth:`~cryptography.x509.Attributes.get_attribute_for_oid`
    instead.
  * Removed the deprecated CAST5, SEED, IDEA, and Blowfish
    classes from the cipher module. These are still available in
    :doc:`/hazmat/decrepit/index`.
  * In X.509, when performing a PSS signature with a SHA-3 hash,
    it is now encoded with the official NIST SHA3 OID.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1765195200">- Only require pytest-subtests with pytest &lt; 9.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1770897600">- Update to 46.0.5 (fixes CVE-2026-26007, bsc#1258074)
  * An attacker could create a malicious public key that reveals portions of
    your private key when using certain uncommon elliptic curves (binary
    curves). This version now includes additional security checks to prevent
    this attack. This issue only affects binary elliptic curves, which are
    rarely used in real-world applications. Credit to XlabAI Team of Tencent
    Xuanwu Lab and Atuin Automated Vulnerability Discovery Engine for reporting
    the issue. CVE-2026-26007
  * Support for SECT* binary elliptic curves is deprecated and will be removed
    in the next release.
- Update to 46.0.4
  * Dropped support for win_arm64 wheels.
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.5.
- Update to 46.0.3
  * Fixed compilation when using LibreSSL 4.2.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1774612800">- update to 46.0.6 (CVE-2026-34073, bsc#1260876):
  * SECURITY ISSUE: Fixed a bug where name constraints were not
    applied to peer names during verification when the leaf
    certificate contains a wildcard DNS SAN. Ordinary X.509
    topologies are not affected by this bug, including those used
    by the Web PKI. Credit to Oleh Konko (1seal) for reporting
    the issue. CVE-2026-34073</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1774958400">- Add patch support-maturin-1.12.patch:
  * Correctly deal with maturin bugfix that installs tests and
    docs under sitearch.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1775822400">- Update to 46.0.7 (fixes CVE-2026-39892, bsc#1261863)
  * **SECURITY ISSUE**: Fixed an issue where non-contiguous buffers could be
    passed to APIs that accept Python buffers, which could lead to buffer
    overflow. **CVE-2026-39892**
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.6.
- drop support-maturin-1.12.patch (upstream)
- drop no-pytest_benchmark.patch,
  Make-unsafe-subinterpreter-support-available-via-cfg.patch:
  obsolete</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1777204800">- update to 47.0.0:
  * Support for Python 3.8 is deprecated and will be removed in
    the next cryptography release.
  * BACKWARDS INCOMPATIBLE: Support for binary elliptic curves
    (SECT* classes) has been removed. These curves are rarely
    used and have additional security considerations that make
    them undesirable.
  * BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.1.x has been
    removed. OpenSSL 3.0.0 or later is now required. LibreSSL,
    BoringSSL, and AWS-LC continue to be supported.
  * BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL &lt; 4.1.
  * BACKWARDS INCOMPATIBLE: Loading keys with unsupported
    algorithms or keys with unsupported explicit curve encodings
    now raises
    :class:`~cryptography.exceptions.UnsupportedAlgorithm`
    instead of ValueError. This change affects :func:`~cryptograp
    hy.hazmat.primitives.serialization.load_pem_private_key`, :fu
    nc:`~cryptography.hazmat.primitives.serialization.load_der_pr
    ivate_key`, :func:`~cryptography.hazmat.primitives.serializat
    ion.load_pem_public_key`, :func:`~cryptography.hazmat.primiti
    ves.serialization.load_der_public_key`, and
    :meth:`~cryptography.x509.Certificate.public_key` when called
    on certificates with unsupported public key algorithms.
  * BACKWARDS INCOMPATIBLE: When parsing elliptic curve private
    keys, we now reject keys that incorrectly encode a private
    key of the wrong length because such keys are impossible to
    process in a constant-time manner. We do not believe keys
    with this problem are in wide use, however we may revert this
    change based on the feedback we receive.
  * Deprecated passing 64-bit (8-byte) and 128-bit (16-byte) keys
    to :class:`~cryptography.hazmat.decrepit.ciphers.algorithms.T
    ripleDES`. In a future release, only 192-bit (24-byte) keys
    will be accepted. Users should expand shorter keys themselves
    (e.g., for single DES: key + key + key, for two-key: key +
    key[:8]).
  * Updated the minimum supported Rust version (MSRV) to 1.83.0,
    from 1.74.0.
  * Support for x86_64 macOS (including publishing wheels) is
    deprecated and will be removed in the next release. We will
    switch to publishing an arm64 only wheel for macOS.
  * Support for 32-bit Windows (including publishing wheels) is
    deprecated and will be removed in the next release. Users
    should move to a 64-bit Python installation.
  * public_bytes and private_bytes methods on keys now raise
    TypeError (instead of ValueError) if an invalid encoding is
    provided for the given format.
  * Moved
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.CFB`,
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.OFB`, and
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.CFB8`
    into :doc:`/hazmat/decrepit/index` and deprecated them in the
    modes module. They will be removed from the modes module in
    49.0.0.
  * Moved :class:`~cryptography.hazmat.primitives.ciphers.algorit
    hms.Camellia` into  :doc:`/hazmat/decrepit/index` and
    deprecated it in the cipher module. It will be removed from
    the cipher module in 49.0.0.
  * Added
    :meth:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF.extract`
    to :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF`.
    The previous private implementation will be removed in
    49.0.0.
  * Added support for loading elliptic curve keys that contain
    explicit encodings of the curves secp256r1, secp384r1, and
    secp521r1.
  * Added support for
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2d`
    and
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2i`
    when using OpenSSL 3.2.0+.
  * Added derive_into methods to
    :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF`,
    :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDFExpand`,
    :class:`~cryptography.hazmat.primitives.kdf.concatkdf.ConcatK
    DFHash`, :class:`~cryptography.hazmat.primitives.kdf.concatkd
    f.ConcatKDFHMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2id`,
    :class:`~cryptography.hazmat.primitives.kdf.pbkdf2.PBKDF2HMAC
    `,
    :class:`~cryptography.hazmat.primitives.kdf.kbkdf.KBKDFHMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.kbkdf.KBKDFCMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.scrypt.Scrypt`,
    and
    :class:`~cryptography.hazmat.primitives.kdf.x963kdf.X963KDF`
    to allow deriving keys directly into pre-allocated buffers.
  * Added encrypt_into and decrypt_into methods to
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESCCM`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESGCM`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESGCMSI
    V`, :class:`~cryptography.hazmat.primitives.ciphers.aead.AESO
    CB3`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESSIV`,
    and :class:`~cryptography.hazmat.primitives.ciphers.aead.ChaC
    ha20Poly1305` to allow encrypting directly into a pre-
    allocated buffer.
  * Added support for PKCS1v15 signing without DigestInfo using :
    class:`~cryptography.hazmat.primitives.asymmetric.utils.NoDig
    estInfo`.
  * Added
    :meth:`~cryptography.hazmat.primitives.hashes.Hash.hash`, a
    one-shot method for computing hashes.
  * Added :doc:`/hazmat/primitives/hpke` support implementing RFC
    9180 for hybrid authenticated encryption.
  * Added new :doc:`/hazmat/primitives/asymmetric/mlkem` module
    with support for ML-KEM key encapsulation with AWS-LC and
    BoringSSL. Note: Post-quantum algorithm support requires AWS-
    LC or BoringSSL. As we ship our wheels with OpenSSL, most
    users will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Note: Post-quantum algorithm support requires AWS-LC or
    BoringSSL. As we ship our wheels with OpenSSL, most users
    will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Added new :doc:`/hazmat/primitives/asymmetric/mldsa` module
    with support for ML-DSA signing and verification with AWS-LC
    and BoringSSL. Note: Post-quantum algorithm support requires
    AWS-LC or BoringSSL. As we ship our wheels with OpenSSL, most
    users will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Note: Post-quantum algorithm support requires AWS-LC or
    BoringSSL. As we ship our wheels with OpenSSL, most users
    will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Added new :doc:`/hazmat/asn1/index` module with support for
    declaratively defining custom ASN.1 types and
    encoding/decoding them.
  * Fixed compilation when using LibreSSL 4.3.0 and OpenSSL
    4.0.0.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 4.0.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1778414400">- update to 48.0.0:
  * BACKWARDS INCOMPATIBLE: Support for Python 3.8 has been
    removed. cryptography now requires Python 3.9 or later.
  * BACKWARDS INCOMPATIBLE: Loading an X.509 CRL whose inner
    TBSCertList.signature algorithm does not match the outer
    signatureAlgorithm now raises ValueError. Previously, such
    CRLs were parsed successfully and only rejected during
    signature validation.
  * Added support for :doc:`/hazmat/primitives/asymmetric/mlkem`
    and :doc:`/hazmat/primitives/asymmetric/mldsa` when using
    OpenSSL 3.5.0 or later, in addition to the existing AWS-LC
    and BoringSSL support. This means post-quantum algorithms are
    now available to users of our wheels. Note: Going forward, we
    do not guarantee that all functionality in cryptography will
    be available when building against OpenSSL. See
    :doc:`/statements/state-of-openssl` for more information.
  * Note: Going forward, we do not guarantee that all
    functionality in cryptography will be available when building
    against OpenSSL. See :doc:`/statements/state-of-openssl` for
    more information.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1781438400">- update to 49.0.0:
  * BACKWARDS INCOMPATIBLE: Removed the deprecated
    PUBLIC_KEY_TYPES, PRIVATE_KEY_TYPES,
    CERTIFICATE_PRIVATE_KEY_TYPES,
    CERTIFICATE_ISSUER_PUBLIC_KEY_TYPES, and
    CERTIFICATE_PUBLIC_KEY_TYPES type aliases. Use
    PublicKeyTypes, PrivateKeyTypes,
    CertificateIssuerPrivateKeyTypes,
    CertificateIssuerPublicKeyTypes, and
    CertificatePublicKeyTypes instead. These were deprecated in
    version 40.0.
  * BACKWARDS INCOMPATIBLE: :class:`~cryptography.hazmat.primitiv
    es.ciphers.algorithms.ChaCha20` now treats the first 4 bytes
    of the nonce as a 32-bit little-endian block counter (as
    defined in RFC 7539) and tracks the number of bytes
    processed. Attempting to encrypt or decrypt more data than
    the counter allows before it would overflow now raises a
    :class:`ValueError` rather than silently diverging from RFC
    7539. Setting the counter portion of the nonce to zero allows
    encrypting up to 256 GiB with a given nonce.
  * BACKWARDS INCOMPATIBLE: Loading an X.509 certificate whose
    ECDSA or DSA signature AlgorithmIdentifier contains encoded
    NULL parameters now raises a :class:`ValueError`. Such
    certificates are invalid, but older versions of Java emitted
    them; previously they loaded with a deprecation warning.
  * Fixed cross-compilation of the CFFI bindings when
    PYO3_CROSS_LIB_DIR is set. The build now derives the Python
    include directory from PYO3_CROSS_LIB_DIR instead of querying
    the host interpreter, which previously caused the build to
    fail during cross-compilations for embedded systems, on hosts
    which have same-version Python development headers installed
    as the target Python.
  * Added support for signing and verifying X.509 certificates,
    certificate signing requests, and certificate revocation
    lists with :doc:`/hazmat/primitives/asymmetric/mldsa` keys,
    as well as loading certificates that contain ML-DSA public
    keys.
  * Added
    :meth:`~cryptography.hazmat.primitives.hpke.KEM.enc_length`
    to :class:`~cryptography.hazmat.primitives.hpke.KEM` so
    callers can split the encapsulated key from the ciphertext
    returned by
    :meth:`~cryptography.hazmat.primitives.hpke.Suite.encrypt`.
  * :meth:`~cryptography.x509.verification.ExtensionPolicy.requir
    e_present`, :meth:`~cryptography.x509.verification.ExtensionP
    olicy.may_be_present`, and :meth:`~cryptography.x509.verifica
    tion.ExtensionPolicy.require_not_present` now accept any
    extension type. Previously only a fixed set of extension
    types was supported, which made it impossible to account for
    otherwise unrecognized critical extensions during path
    validation.
  * Added support for using
    :class:`~cryptography.x509.Certificate`,
    :class:`~cryptography.x509.CertificateSigningRequest`, and
    :class:`~cryptography.x509.CertificateRevocationList` as
    field types in :doc:`/hazmat/asn1/index` structures.
  * Added :func:`~cryptography.hazmat.asn1.value_set`, a class
    decorator that registers an :class:`enum.Enum` subclass as an
    ASN.1 value set: members are encoded as their underlying
    value, and decoding fails if the decoded value does not match
    one of the declared members.
  * Added :meth:`~cryptography.x509.Name.from_bytes` for parsing
    a :class:`~cryptography.x509.Name` from DER bytes, the
    inverse of :meth:`~cryptography.x509.Name.public_bytes`.
  * Added the rsa_padding keyword-only parameter to
    :meth:`~cryptography.x509.CertificateBuilder.public_key`.
    Passing the :class:`~cryptography.hazmat.primitives.asymmetri
    c.padding.PSS` class (not an instance) encodes an RSA subject
    public key in the certificate's subjectPublicKeyInfo with the
    id-RSASSA-PSS OID and no parameters.
  * Added external mu (message representative) support to
    :doc:`/hazmat/primitives/asymmetric/mldsa` via the sign_mu
    and verify_mu methods, which sign and verify a precomputed
    64-byte mu as defined in FIPS 204.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 4.0.1.</changelog>
</package>
<package pkgid="ef7b6c723ef6896350e97b3dd8db45540c6ccd425dd63d434fe91a5aa06d42788b714145867c3de2fa01a5baabfa198b1e5601f2382e39bac69d4013c121ba76" name="python-libnacl" arch="src">
  <version epoch="0" ver="2.1.0" rel="63.13"/>
  <changelog author="aboe76@gmail.com" date="1426593600">- Updated to 1.4.2
  + Add support to save and load SecretBox keys</changelog>
  <changelog author="aboe76@gmail.com" date="1434024000">- Updated to 1.4.3
- crypto_onetimeauth_verify fixes
  + Fix a call to the crypto_onetimeauth_verify routine into the right libsodium system
  + Add tests for crypto_onetimeauth_verify
- Add support for reading file streams for key loading</changelog>
  <changelog author="mrueckert@suse.de" date="1447934400">- fix libsodium loading on Tumbleweed: soversion was bumped to 17
  reported as https://github.com/saltstack/libnacl/pull/60
  adds libnacl-1.4.3_bump_libsodium_soversion.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1447934401">- make sure we require the libsodium version we were built with</changelog>
  <changelog author="mrueckert@suse.de" date="1447934402">- no longer build as noarch package, while the code is still
  noarch. we actually depend on the native library at runtime. To
  be able to make this work properly we need to require that native
  library, that native requires makes us arch dependent.</changelog>
  <changelog author="aboe76@gmail.com" date="1451908800">- Updated to 1.4.4
  - Add pack_nonce options to secretbox
    libnacl secretbox has been packing the nonce in each message,
    the new pack_nonce option allows for the nonce to be omitted
    which allows for more flexible options
  - Add soversion 17 detection
    Added explicit soversion support for libsodium 17
  - Fix crypto_onetimeauth tests
    The crypto onetimeauth test issues have been resolved
  - Remove tweetnacl Support
    The tweetnacl support was never really tested, and since the
    tweetnacl api is not complete we have removed support for it
  - Add sodium_init calls
    Added calls to sodium_init when the lib is loaded
  - packaging:
  - New BuildRequirement python-setuptools
  - Updated the description
  - Removed the patch for soname: libnacl-1.4.3_bump_libsodium_soversion.patch
    not needed anymore</changelog>
  <changelog author="dmacvicar@suse.de" date="1452772800">- Add libnacl-1.4.4-libsodium18.patch to find libsodium 1.0.8
- Fix BuildRequires to avoid building with a newer version
  of libsodium than 1.0.8</changelog>
  <changelog author="dmacvicar@suse.de" date="1452772801">- remove the escaped epoch to prevent the build service to
  auto replace it and break the macro.</changelog>
  <changelog author="zaitor@opensuse.org" date="1460548800">- Add conditional pkgconfig(libsodium) BuildRequires for all
  openSUSE versions newer than 13.1.</changelog>
  <changelog author="adrian@suse.de" date="1513944000">- update to version 1.6.1 from github
- drop obsolete patch libnacl-1.4.4-libsodium18.patch
- enable python3 builds</changelog>
  <changelog author="tchvatal@suse.com" date="1533902400">- Fix the libsodium dependency on the runtime to be copied by macros
- Install license file</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1571054400">- Replace %fdupes -s with plain %fdupes; hardlinks are better.</changelog>
  <changelog author="Ond&#x159;ej S&#xFA;kup &lt;mimi.vx@gmail.com&gt;" date="1583236800">- update to 1.7.1
  * Bindings for kdf in libsodium
  * Added extra key validation
  * Add Crypto_box_easy</changelog>
  <changelog author="Niels Abspoel &lt;aboe76@gmail.com&gt;" date="1612180800">- Update to 1.7.2
  * remove encoding parameter json.loads for python 3.9 compatibility
  * implement functions for equal-comparison and hashing keys
  * improved spec file</changelog>
  <changelog author="Niels Abspoel &lt;aboe76@gmail.com&gt;" date="1613649600">- Revert libsodium requirement back to libsodium23</changelog>
  <changelog author="Niels Abspoel &lt;aboe76@gmail.com&gt;" date="1623412800">- add crypto_kdf_derive.patch to fix crypto_kdf_derive_from_key() on 32-bit platforms</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1688558400">- Add %{?sle15_python_module_pythons}</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1709294400">- Update to 2.1.0:
  * Added classes to the libnacl.aead module allowing for the use of
    XChaCha20-Poly1305-IETF, ChaCha20-Poly1305-IETF, and AES256-GCM.
  * Added the libnacl.kx module. This module contains the ExchangeKey class.
- Switch to autosetup and pyproject macros.
- Drop patch crypto_kdf_derive.patch, no longer required.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1718193600">- update to libsodium26</changelog>
  <changelog author="Max Lin &lt;mlin@suse.com&gt;" date="1755864000">- Use BuildRequires: poetry-core to instead of BuildRequires: poetry</changelog>
</package>
<package pkgid="4bff7a91c4462ecb5461b7a6279bd17f4d746a38a5cfc6c7319408d259a5b0d27c9eaf3becea3c1ecab8ae002b9a718218b695bca64b1512e0d668db2febb041" name="python-logutils" arch="src">
  <version epoch="0" ver="0.3.5" rel="30.30"/>
  <changelog author="speilicke@suse.com" date="1374148800">- Initial version</changelog>
  <changelog author="tbechtold@suse.com" date="1498737600">- update to 0.3.5:
  - Bring QueueListener implementation in line with the version in the stdlib.
  - Fixed a bug in ColorizingStreamHandler relating to encoding.
  - Return non-zero error code from "setup.py test" when a test fails.
  - Make the dictConfig tests work with both Python 2.x and 3.x.
- convert to singlespec
- fix Source url
- split -doc package
- update Url</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1543924800">- Remove superfluous devel dependency for noarch package</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1622894400">- add sphinx4.patch to enable build with Sphinx 4.x</changelog>
  <changelog author="pgajdos@suse.com" date="1630497600">- %check: use %pyunittest rpm macro</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1676635200">- update path for SLE15</changelog>
  <changelog author="Ben Greiner &lt;code@bnavigator.de&gt;" date="1705579200">- Add logutils-pr1-fix-testasserts-py3.12.patch
  * https://bitbucket.org/vinay.sajip/logutils/pull-requests/1
  * Fixes the test suite. This package is really old but still
    half-maintained
- Switch to PEP517
- Deduplicate files</changelog>
  <changelog author="Christoph G &lt;foss@grueninger.de&gt;" date="1725537600">- Add patch logutils-intersphinx.patch to fix compatibility
  with recent Sphinx</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1725969600">- Add patch use-logging-lock-directly.patch:
  * Use logging._lock as a context manager.
- Switch to autosetup macro.</changelog>
</package>
<package pkgid="cd48c9504dc0e7deab4f528646cc04a587ab9b3e442ef4d13238d0a99d98bc02bc426facc797736c280850d2870d72dc67ad7bd6f96a4ea669340f611ee4fbc7" name="python-logutils-doc" arch="noarch">
  <version epoch="0" ver="0.3.5" rel="30.30"/>
  <changelog author="speilicke@suse.com" date="1374148800">- Initial version</changelog>
  <changelog author="tbechtold@suse.com" date="1498737600">- update to 0.3.5:
  - Bring QueueListener implementation in line with the version in the stdlib.
  - Fixed a bug in ColorizingStreamHandler relating to encoding.
  - Return non-zero error code from "setup.py test" when a test fails.
  - Make the dictConfig tests work with both Python 2.x and 3.x.
- convert to singlespec
- fix Source url
- split -doc package
- update Url</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1543924800">- Remove superfluous devel dependency for noarch package</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1622894400">- add sphinx4.patch to enable build with Sphinx 4.x</changelog>
  <changelog author="pgajdos@suse.com" date="1630497600">- %check: use %pyunittest rpm macro</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1676635200">- update path for SLE15</changelog>
  <changelog author="Ben Greiner &lt;code@bnavigator.de&gt;" date="1705579200">- Add logutils-pr1-fix-testasserts-py3.12.patch
  * https://bitbucket.org/vinay.sajip/logutils/pull-requests/1
  * Fixes the test suite. This package is really old but still
    half-maintained
- Switch to PEP517
- Deduplicate files</changelog>
  <changelog author="Christoph G &lt;foss@grueninger.de&gt;" date="1725537600">- Add patch logutils-intersphinx.patch to fix compatibility
  with recent Sphinx</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1725969600">- Add patch use-logging-lock-directly.patch:
  * Use logging._lock as a context manager.
- Switch to autosetup macro.</changelog>
</package>
<package pkgid="f01b55344a1e9b35b3395813a9fdc9cf85d550f3c2701a1ee095b92c68a78da71d8cb6a4d630cd0d2744f0f4ffd34cd6ea06828ad38dbf4d7f9a330f31f1f597" name="python-pecan" arch="src">
  <version epoch="0" ver="1.4.2" rel="79.2"/>
  <changelog author="dmueller@suse.com" date="1479211200">- update to 1.2.1</changelog>
  <changelog author="tbechtold@suse.com" date="1498737600">- convert to singlespec
- fix Source url</changelog>
  <changelog author="tbechtold@suse.com" date="1499860800">- Only require python-singledispatch on python2</changelog>
  <changelog author="tbechtold@suse.com" date="1503576000">- Add pull-request-91.patch . That fixes the tests for python3.6</changelog>
  <changelog author="tchvatal@suse.com" date="1533816000">- Version update to 1.3.2:
  * Fixes for newer webob and other dependencies
- Drop merged patch pull-request-91.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1533816001">- Do not depend on Kajiki as it is Genshi clone:
  * pecan-no-kajiki.patch</changelog>
  <changelog author="jengelh@inai.de" date="1534420800">- Ensure neutrality of description.</changelog>
  <changelog author="comurphy@suse.com" date="1534939200">- Add python-pysqlite dependency
  * Needed for the unit tests</changelog>
  <changelog author="pgajdos@suse.com" date="1556107200">- version update to 1.3.3
  * fixed a bug in RestController that incorrectly routed certain
    @secure requests (https://github.com/pecan/pecan/pull/105)
  * removed official support for Python 3.3</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1575892800">- There doesn't seem to be any reason to depend on
  python-pysqlite anymore.</changelog>
  <changelog author="Tom&#xE1;&#x161; Chv&#xE1;tal &lt;tchvatal@suse.com&gt;" date="1584187200">- Fix build without python2</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1620216000">- version update to 1.4.0
  * pecan now requires webob &gt;= 1.8
  * fixed a bug when parsing certain Accept headers
    (https://github.com/Pylons/webob/issues/403)
  * removed official support for Python 3.5
- Rebase patch:
  * pecan-no-kajiki.patch
- Add patches to support SQLAlchemy 1.4.x (gh#pecan/pecan#125)
  * 0001-Support-SQLAlchemy-1.4.x.patch
  * 0002-Fix-typo-from-bad-copy-paste.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1622116800">- %check: use %pyunittest macro</changelog>
  <changelog author="Stefan Schubert &lt;schubi@suse.de&gt;" date="1633089600">- Use libalternatives instead of update-alternatives.</changelog>
  <changelog author="Stefan Schubert &lt;schubi@suse.de&gt;" date="1633435200">- Added BuildRequires:  alts</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1639224000">- update to 1.4.1:
  * add support for Python 3.10
  * added trove classifiers for Python 3.6 - 3.9
  * fixed a bug related to setuptools as a dependency
  * fixed a bug that broke pecan when used with certain
  versions of SQLAlchemy
- drop 0001-Support-SQLAlchemy-1.4.x.patch,
  0002-Fix-typo-from-bad-copy-paste.patch: obsolete (upstream)</changelog>
  <changelog author="pgajdos@suse.com" date="1649246400">- python-mock is not required for build</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1658232000">- update to 1.4.2:
  * pecan no longer depends on webtest</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1674907200">- restore webtest dependency, needed by pecan.testing</changelog>
  <changelog author="Mark&#xE9;ta Machov&#xE1; &lt;mmachova@suse.com&gt;" date="1684756800">- add sqlalchemy2.patch to support SQLAlchemy 2.0</changelog>
</package>
<package pkgid="6fb910a598f45956ebf23c05de44bf772756023e9ef6852bc0cbedaff0a24334b3f3e72344afe066d419a41855767f9f3f7a97e5845f3a46550a381d9eaae4cb" name="python310-pecan" arch="noarch">
  <version epoch="0" ver="1.4.2" rel="79.2"/>
  <changelog author="Tom&#xE1;&#x161; Chv&#xE1;tal &lt;tchvatal@suse.com&gt;" date="1584187200">- Fix build without python2</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1620216000">- version update to 1.4.0
  * pecan now requires webob &gt;= 1.8
  * fixed a bug when parsing certain Accept headers
    (https://github.com/Pylons/webob/issues/403)
  * removed official support for Python 3.5
- Rebase patch:
  * pecan-no-kajiki.patch
- Add patches to support SQLAlchemy 1.4.x (gh#pecan/pecan#125)
  * 0001-Support-SQLAlchemy-1.4.x.patch
  * 0002-Fix-typo-from-bad-copy-paste.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1622116800">- %check: use %pyunittest macro</changelog>
  <changelog author="Stefan Schubert &lt;schubi@suse.de&gt;" date="1633089600">- Use libalternatives instead of update-alternatives.</changelog>
  <changelog author="Stefan Schubert &lt;schubi@suse.de&gt;" date="1633435200">- Added BuildRequires:  alts</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1639224000">- update to 1.4.1:
  * add support for Python 3.10
  * added trove classifiers for Python 3.6 - 3.9
  * fixed a bug related to setuptools as a dependency
  * fixed a bug that broke pecan when used with certain
  versions of SQLAlchemy
- drop 0001-Support-SQLAlchemy-1.4.x.patch,
  0002-Fix-typo-from-bad-copy-paste.patch: obsolete (upstream)</changelog>
  <changelog author="pgajdos@suse.com" date="1649246400">- python-mock is not required for build</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1658232000">- update to 1.4.2:
  * pecan no longer depends on webtest</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1674907200">- restore webtest dependency, needed by pecan.testing</changelog>
  <changelog author="Mark&#xE9;ta Machov&#xE1; &lt;mmachova@suse.com&gt;" date="1684756800">- add sqlalchemy2.patch to support SQLAlchemy 2.0</changelog>
</package>
<package pkgid="c24d7e9271469844b01cbf5be0b485b66fe67b77ce53f32f1cacd87b392a71edbd24daeca6639299f2730a0084ec675486394e5c2f10de11f87adb4e71cf67e7" name="python311-Routes" arch="noarch">
  <version epoch="0" ver="2.5.1" rel="56.7"/>
  <changelog author="tbechtold@suse.com" date="1464955200">- update to 2.3.1:
  * Backwards compatability fix - connect should work with mandatory
    routename and optional path. Patch by Davanum Srinivas (PR #65).
  * Fix sub_domain equivalence check. Patch by Nikita Uvarov
  * Add support for protocol-relative URLs generation (i.e. starting with double
    slash ``//``). PR #60. Patch by Sviatoslav Sydorenko.
  * Add support for the ``middleware`` extra requirement, making possible to
    depend on ``webob`` optionally. PR #59. Patch by Sviatoslav Sydorenko.
  * Fix matching of an empty string route, which led to exception in earlier
    versions. PR #58. Patch by Sviatoslav Sydorenko.
  * Add support for the ``requirements`` option when using
    mapper.resource to create routes. PR #57. Patch by Sean Dague.
  * Concatenation fix when using submappers with path prefixes. Multiple
    submappers combined the path prefix inside the controller argument in
    non-obvious ways. The controller argument will now be properly carried
    through when using submappers. PR #28.</changelog>
  <changelog author="tbechtold@suse.com" date="1498737600">- update to 2.4.1:
  * Release as a universal wheel. PR #75.
  * Convert readthedocs links for their .org -&gt; .io migration for hosted projects.
- convert to singlespec
- Fix Source url</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1543924800">- Remove superfluous devel dependency for noarch package</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1573128000">- Run through spec-cleaner</changelog>
  <changelog author="pgajdos@suse.com" date="1592395200">- nose -&gt; pytest</changelog>
  <changelog author="Dirk Mueller &lt;dmueller@suse.com&gt;" date="1606392000">- update to 2.5.1:
  * Add compatibility for Python 3.7+.
  * Add graceful fallback for invalid character encoding from request object.
  * Enhanced performance for matching routes that share the same static prefix.
  * Fixed issue with child routes not passing route conditions to the Mapper.connect call.
  * Fixed documentation to reflect default value for minimization.
  * Allow backslash to escape special characters in route paths.
  * Resolve invalid escape sequences.
  * Remove support for Python 2.6, 3.3, and 3.4.
  * Remove obsolete Python 2.3 compat code.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1636372800">- add six dependency declaration</changelog>
  <changelog author="Ben Greiner &lt;code@bnavigator.de&gt;" date="1660824000">- Clean specfile, remove coverage</changelog>
  <changelog author="Mark&#xE9;ta Machov&#xE1; &lt;mmachova@suse.com&gt;" date="1717761600">- Add remove-six.patch to get rid of six</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1750766400">- Switch to pyproject macros.</changelog>
</package>
<package pkgid="635990f97b52ac9b83c07872a8fe09d498c05595e9bfdb8247af425338a9e9b3b1619bebfbc13bcb72923b0d38641051993df0105d285437e5bd4fb294a9ec70" name="python311-asyncssh" arch="noarch">
  <version epoch="0" ver="2.23.1" rel="75.1"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1672920000">- update to 2.13.0:
  * Updated testing and coverage to drop Python 3.6 and add Python 3.11.
  * Added new "recv_eof" option to not pass an EOF from a channel to a
    redirected target, allowing output from multiple SSH sessions to be
    sent and mixed with other direct output to that target.
  * Added new methods to make it easy to perform forwarding between TCP
    ports and UNIX domain sockets.
  * Added a workaround for a problem seen on a Huawei SFTP server where
    it sends an invalid combination of file attribute flags.
  * Fixed an issue with copying files to SFTP servers that don't support
    random access I/O.
  * Fixed an issue when requesting remote port forwarding on a dynamically
    allocated port.
  * Fixed an issue where readexactly could block indefinitely when a signal
    is delivered in the stream before the requested number of bytes are
    available.
  * Fixed an interoperability issue with OpenSSH when using SSH certificates
    with RSA keys with a SHA-2 signature.
  * Fixed an issue with handling "None" in ProxyCommand, GlobalKnownHostsFile,
    and UserKnownHostsFile config file options.</changelog>
  <changelog author="Daniel Garcia &lt;daniel.garcia@suse.com&gt;" date="1674648000">- Add remove-sha1.patch to make it compatible with latests versions of
  cryptography gh#ronf/asyncssh@fae5a9e8baad</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1678104000">- update to 2.13.1:
  * Updated type definitions for mypy 1.0.0, removing a
    dependency on implicit Optional types, and working around an
    issue that could trigger a mypy internal error.
  * Updated unit tests to avoid calculation of SHA-1 signatures,
    which are no longer allowed in cryptography 39.0.0.
- drop remove-sha1.patch (upstream)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1688212800">- update to 2.13.2:
  * Fixed an issue with host-based authentication when using
    proxy_command, allowing it to be used if the caller
    explicitly specifies client_host.
  * Improved handling of signature algorithms for OpenSSH
    certificates so that RSA SHA-2 signatures will work with
    both older and newer versions of OpenSSH.
  * Worked around an issue with some Cisco SSH implementations
    generating invalid "ignore" packets.
  * Fixed unit tests to avoid errors when cryptography's version
    of * OpenSSL disables support for SHA-1 signatures.
  * Fixed unit tests to avoid errors when the filesystem enforces
    that filenames be valid UTF-8 strings.
  * Added documentation about which config options apply when
    passing a string as a tunnel argument.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1696507200">- update to 2.14.0:
  * Added support for a new accept_handler argument when setting
    up local port forwarding, allowing the client host and port to
    be validated and/or logged for each new forwarded connection.
  * Added an option to disable expensive RSA private key checks
    when using OpenSSL 3.x. Functions that read private keys have
    been modified to include a new unsafe_skip_rsa_key_validation
    argument which can be used to avoid these additional checks,
    if you are loading keys from a trusted source.
  * Added host information into AsyncSSH exceptions when host key
    validation fails, and a few other improvements related to
    X.509 certificate validation errors.
  * Fixed a regression which prevented keys loaded into an SSH
    agent with a certificate from working correctly beginning in
    AsyncSSH after version 2.5.0.
  * Fixed an issue which was triggering an internal exception
    when shutting down server sessions with the line editor enabled
    which could cause some output to be lost on exit, especially when
    running on Windows.
  * Fixed a documentation error in SSHClientConnectionOptions and
    SSHServerConnectionOptions.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1699617600">- update to 2.14.1 (bsc#1217028, CVE-2023-46445):
  * Hardened AsyncSSH state machine against potential message
    injection attacks, described in more detail in
    `CVE-2023-46445 and CVE-2023-46446
  * Added support for passing in a regex in readuntil in
    SSHReader,
  * Added support for get_addresses() and get_port() methods on
  * SSHAcceptor.
  * Fixed an issue with AsyncFileWriter potentially writing data
  * out of order.
  * Updated testing to include Python 3.12.
  * Updated readthedocs integration to use YAML config file.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1702900800">- update to 2.14.2 (bsc#1218165, CVE-2023-48795):
  * Implemented "strict kex" support and other countermeasures to
  * protect against the Terrapin Attack described in
    CVE-2023-48795
  * Fixed config parser to properly an optional equals delimiter
    in all config arguments.
  * Fixed TCP send error handling to avoid race condition when
    receiving incoming disconnect message.
  * Improved type signature in SSHConnection async context
    manager.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1723204800">- update to 2.15.0:
  * Added experimental support for tunneling of TUN/TAP network
    interfaces on Linux and macOS, allowing for either automatic
    packet forwarding or explicit reading and writing of packets
    sent through the tunnel by the application. Both callback and
    stream APIs are available.
  * Added support for forwarding terminal size and terminal size
    changes when stdin on an SSHServerProcess is redirected to a
    local TTY.
  * Added support for multiple tunnel/ProxyJump hosts. Thanks go
    to Adam Martin for suggesting this enhancement and proposing
    a solution.
  * Added support for OpenSSH lsetstat SFTP extension to set
    attributes on symbolic links on platforms which support that
    and use it to improve symlink handling in the SFTP get, put,
    and copy methods. In addition, a follow_symlinks option has
    been added on various SFTPClient methods which get and set
    these attributes. Thanks go to GitHub user eyalgolan1337 for
    reporting this issue.
  * Added support for password and passphrase arguments to be a
    callable or awaitable, called when performing authentication
    or loading encrypted private keys. Thanks go to GitHub user
    goblin for suggesting this enhancement.
  * Added support for proper flow control when using
    AsyncFileWriter or StreamWriter classes to do SSH process
    redirection. Thanks go to Benjy Wiener for reporting this
    issue and providing feedback on the fix.
  * Added is_closed() method
    SSHClientConnection/SSHServerConnection to return whether the
    associated network connection is closed or not.
  * Added support for setting and matching tags in OpenSSH config
    files.
  * Added an example of using "await" in addition to "async with"
    when opening a new SSHClientConnection. Thanks go to Michael
    Davis for suggesting this added documentation.
  * Improved handling CancelledError in SCP, avoiding an issue
    where AsyncSSH could sometimes get stuck waiting for the
    channel to close. Thanks go to Max Orlov for reporting the
    problem and providing code to reproduce it.
  * Fixed a regression from 2.14.1 related to rekeying an SSH
    connection when there's acitivty on the connection in the
    middle of rekeying. Thanks go to GitHub user eyalgolan1337
    for helping to narrow down this problem and test the fix.
  * Fixed a problem with process redirection when a close is
    received without a preceding EOF. Thanks go to GitHub user
    xuoguoto who helped to provide sample scripts and ran tests
    to help track this down.
  * Fixed the processing of paths in SFTP client symlink
    requests. Thanks go to André Glüpker for reporting the
    problem and providing test code to demonstrate it.
  * Fixed an OpenSSH config file parsing issue. Thanks go to
    Siddh Raman Pant for reporting this issue.
  * Worked around a bug in a user auth banner generated by the
    cryptlib library. Thanks go to GitHub user mmayomoar for
    reporting this issue and suggesting a fix.</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1727352000">- update to 2.17.0:
  * Add support for specifying a per-connection credential store
    for GSSAPI authentication.
  * Fixed a regression introduced in AsyncSSH 2.15.0 which could
    cause connections to be closed with an uncaught exception when
    a session on the connection was closed.
  * Added a workaround where getaddrinfo() on some systems may
    return duplicate entries, causing bind() to fail when opening
    a listener.
  * Relaxed padding length check on OpenSSH private keys to
    provide better compatibility with keys generated by PuTTYgen.
  * Improved documentation on SSHClient and SSHServer classes to
    explain when they are created and their relationship to the
    SSHClientConnection and SSHServerConnection classes.
  * Updated examples to use Python 3.7 and made some minor
    improvements.
- update to 2.16.0:
  * Added client and server support for the OpenSSH "hostkeys"
    extension. When using known_hosts, clients can provide a
    handler which will be called with the changes between the
    keys currently trusted in the client's known hosts and those
    available on the server. On the server side, an application
    can choose whether or not to enable the sending of this host
    key information.
  * Related to the above, AsyncSSH now allows the configuration of
    multiple server host keys of the same type when the
    send_server_host_keys option is enabled. Only the first key of
    each type will be used in the SSH handshake, but the others can
    appear in the list of supported host keys for clients to begin
    trusting, allowing for smoother key rotation.
  * Fixed logging and typing issues in SFTP high-level copy
    functions. A mix of bytes, str, and PurePath entries are now
    supported in places where a list of file paths is allowed, and
    the type signatures have been updated to reflect that the
    functions accept either a single path or a list of paths.
  * Improved typing on SFTP listdir() function.
  * Reworked the config file parser to improve on a previous fix
    related to handling key/value pairs with an equals delimiter.
  * Improved handling of ciphers deprecated in cryptography 43.0.0.
  * Improved support for use of Windows pathnames in ProxyCommand.</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1730980800">- Update to 2.18.0
  * Added support for post-quantum ML-KEM key exchange algorithms,
    interoperable with OpenSSH 9.9.
  * Added support for the OpenSSH "limits" extension, allowing the
    client to query server limits such as the maximum supported read
    and write sizes. The client will automatically default to the reported
    maximum size on servers that support this extension.
  * Added more ways to specify environment variables via the `env` option.
    Sequences of either 'key=value' strings or (key, value) tuples are now
    supported, in addition to a dict.
  * Added support for getting/setting environment variables as byte strings
    on platforms which support it. Previously, only Unicode strings were
    accepted and they were always encoded on the wire using UTF-8.
  * Added support for non-TCP sockets (such as a socketpair) as the `sock`
    parameter in connect calls. Thanks go to Christian Wendt for reporting
    this problem and proposing a fix.
  * Changed compression to be disabled by default to avoid it becoming a
    performance bottleneck on high-bandwidth connections. This now also
    matches the OpenSSH default.
  * Improved speed of parallelized SFTP reads when read-ahead goes beyond
    the end of the file. Thanks go to Maximilian Knespel for reporting
    this issue and providing performance measurements on the code before
    and after the change.
  * Improved cancellation handling during SCP transfers.
  * Improved support for selecting the currently available security key
    when the application lists multiple keys to try. Thanks go to GitHub
    user zanda8893 for reporting the issue and helping to work out the
    details of the problem.
  * Improved handling of reverse DNS failures in host-based authentication.
    Thanks go to GitHub user xBiggs for suggesting this change.
  * Improved debug logging of byte strings with non-printable characters.
  * Switched to using an executor on GSSAPI calls to avoid blocking the
    event loop.
  * Fixed handling of "UserKnownHostsFile none" in config files. This
    previously caused it to use the default known hosts, rather than
    disabling known host checking.
  * Fixed a runtime warning about not awaiting a coroutine in unit tests.
  * Fixed a unit test failure on Windows when calling abort on a transport.
  * Fixed a problem where a "MAC verification failed" error was sometimes
    sent on connection close.
  * Fixed SSHClientProcess code to not raise a runtime exception when
    waiting more than once for a process to finish. Thanks go to GitHub
    user starflows for reporting this issue.
  * Handled an error when attempting to import older verions of pyOpenSSL.
    Thanks go to Maximilian Knespel for reporting this issue and testing
    the fix.
  * Updated simple_server example code to switch from crypt to bcrypt,
    since crypt has been removed in Python 3.13. Thanks go to Colin
    Watson for providing this update.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1749816000">- Switch to pyproject macros.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1752321600">- update to 2.21.0:
  * Added sparse file support for SFTP, allowing file copying
    which automatically skips over any "holes" in a source file,
    transferring only the data ranges which are actually present.
  * Added support for applications to request that session,
    connection, or TUN/TAP requests arriving on an
    SSHServerConnection be forwarded out some other established
    SSHClientConnection. Callback methods on SSHServer which
    decide how to handle these requests can now return an
    SSHClientConnection to set up this tunneling, instead of
    having to accept the request and implement their own
    forwarding logic.
  * Further hardened the SSH key exchange process to make
    AsyncSSH more strict when accepting messages during key
    exchange. Thanks go to Fabian Bäumer and Marcus Brinkmann for
    identifying potential issues here.
  * Added support for the auth_completed callback in SSHServer to
    be either a callable or a coroutine, allowing async
    operations to be performed when user authentication completes
    successfully, prior to accepting session requests.
  * Added support for the sftp_factory config argument be either
    a callable or a coroutine, allowing async operations to be
    performed when starting up a new SFTP server session.
  * Fixed a bug where the exit() method of SFTPServer didn't
    handle being declared as a coroutine. Thanks go to C. R.
    Oldham for reporting this issue.
  * Improved handling of exceptions in connection_lost()
    callbacks. Exceptions in connection_lost() will now be
    reported in the debug log, but other cleanup code in AsyncSSH
    will continue, ignoring those exceptions. Thanks go to Danil
    Slinchuk for reporting this issue.
  * Added support for specifying an explicit path when
    configuring agent forwarding. Thanks go to Aleksandr Ilin for
    pointing out that this options supports more than just a
    boolean value.
  * Added support for environment variable expansion in SSH
    config, for options which support percent expansion.
  * Added a new begin_auth callback in SSHClient, reporting the
    username being sent during SSH client authentication. This
    can be useful when the user is conditionally set via an SSH
    config file.
  * Improved strict-kex interoperability during re-keying. Thanks
    go to GitHub user emeryalden for reporting this issue and
    helping to track down the source of the problem.
  * Updated SFTP max_requests default to reduce memory usage when
    using large block sizes.
  * Updated testing to add Python 3.13 and drop Python 3.7,
    avoiding deprecation warnings from the cryptography package.
  * Fixed unit test issues under Windows, allowing unit tests to
    run on Windows on all supported versions of Python.
  * Fixed a couple of issues with Python 3.14. Thanks go to Georg
    Sauthoff for initially reporting this.
  * Added support for WebAuthN authentication with U2F security
    keys, allowing non-admin Windows users to use these keys for
    authentication. Previously, authentication with U2F keys
    worked on Windows, but only for admin users.
  * Added support for hostname canonicalization, compatible with
    the configuration parameters used in OpenSSH, as well as
    support for the "canonical" and "final" match keywords and
    negation support for match. Thanks go to GitHub user
    commonism who suggested this and provided a proposed
    implementation for negation.
  * Added client and server support for SFTP copy-data extension
    and a new SFTP remote_copy() function which allows data to be
    moved between two remote files without downloading and re-
    uploading the data. Thanks go to Ali Khosravi for suggesting
    this addition.
  * Moved project metadata from setup.py to pyproject.toml.
    Thanks go to Marc Mueller for contributing this.
  * Updated SSH connection to keep strong references to
    outstanding tasks, to avoid potential issues with the garbage
    collector while the connection is active. Thanks go to GitHub
    user Birnendampf for pointing out this potential issue and
    suggesting a simple fix.
  * Fixed some issues with block_size argument in SFTP copy
    functions. Thanks go to Krzysztof Kotlenga for finding and
    reporting these issues.
  * Fixed an import error when fido2 package wasn't available.
    Thanks go to GitHub user commonism for reporting this issue.</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1760011200">- Update to 2.21.1
  * Added the capability to defer invoking passphrase callback until
    an encrypted private key is actually used in a signing operation,
    rather than triggering the callback when keys are loaded. This
    will only work when a public key is provided with an encrypted
    private key either explicitly or as part of the key format (such
    as in OpenSSH's private key format).
  * Improved handling of KeyboardInterrupt and task cancellation in
    SCP. Thanks go to Viktor Kertesz for reporting this issue and
    helping to understand the behavior in various versions of Python.
  * Fixed the env option to support mappings other than dict. Thanks
    go to Boris Pavlovic for reporting this issue.
  * Fixed a potential race condition in SSHForwarder cleanup. Thanks
    go to GitHub user misa-hase for reporting this issue and helping
    to test the fix.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1760097600">- Add fido2-compat.patch to restore compatibility with python-fido2 &gt;= 2
- Update requirements from pyproject.toml</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1775217600">- update to 2.22.0:
  * Added a new config option utf8_decode_errors for handling
    UTF-8 decode errors when parsing certain fields in SSH
    packets (disconnect error, debug message, userauth banner,
    channel open failure reason, channel exit signal reason, and
    SFTP error reason). The default continues to behave as
    before, raising a ProtocolError exception, but this option
    allows invalid bytes to be removed or replaced. Thanks go to
    GitHub user Le-Syl21 for suggesting this.
  * Changed config parser to Ignore subdirectories and parse only
    plain files matching a glob pattern in include directives,
    better matching the behavior of other SSH implementations.
    Thanks go to Jacopo Nespolo for contributing this change.
  * Improved a previous fix for a race condition which sometimes
    triggered assertion errors in SSHForwarder. Thanks go to Mike
    Barry for reporting the issue and helping to test the
    improved fix.
  * Removed optional dependency on libnacl/libsodium for chacha20
    and Edwrds curves, now that these are available in all
    supported versions of the cryptography package.
  * Updated asyncssh to use version 2 of the fido2 package, and
    update minimum Python version to 3.10, required by that
    updated package.
  * Fixed issue with the OpenSSL legacy provider on Windows and
    re-enabled OpenSSL use in unit tests on Windows.
  * Inproved "run multiple clients" example to show the hostname
    being accessed by each task.
  * Added unit testing for Python 3.14 and dropped 3.8 and 3.9.
- drop fido2-compat.patch (upstream)</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1781611200">- Update to 2.23.1
  * Fixed an SCP path traversal issue.
  * Expanded previous fix to block unsafe user substitutions in server config.
  * Fixed default value for reuse_address and reuse_port, matching the
    behavior of asyncio.create_server().
- Update to 2.23.0 (fixes CVE-2026-45309, bsc#1268333)
  * Added support for "Match localnetwork".
  * Enabled support for RSA with SHA-2 signatures in ssh-agent and Pageant.
  * Changed MAC algorithm negotation to be skipped when using AEAD ciphers.
  * Improved graceful termination when using ProxyCommand, waiting for the
    ProxyCommand tunnel to close when cleaning up a connection.
  * Blocked unsafe user substitutions from being used in server config.
  * Fixed an issue with config evaluation when "Match final" was combined
    with Hostname directives.
  * Fixed a resource leak in xauth support.
  * Fixed issue with multi-hop ProxyJump directives in a config file not
    working correctly.
  * Fixed string encoding in SFTPName objects returned by realpath().</changelog>
</package>
<package pkgid="4d4fe469058aeb4ee47989ef831330c62a79ca94e35880d0a74b6db36548c7bfdf0cd81b933e65837ee3047d0007f1446732fc5bf4b2618150cf3e2061f8bfa9" name="python311-cffi" arch="aarch64">
  <version epoch="0" ver="2.0.0" rel="117.10"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1673006400">- add 8a3c2c816d789639b49d3ae867213393ed7abdff.patch to resolve
  testsuite failures with Python 3.11</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1681387200">- Make calling of %{sle15modernpython} optional.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1682078400">- add sle15_python_module_pythons (jsc#PED-68)</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1696593600">- Clean up the SPEC file</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1696593601">- Upgrade to 1.16.0:
  - Add support for Python 3.12. With the removal of distutils
    from Python 3.12, projects using CFFI features that depend on
    distutils at runtime must add a dependency on setuptools to
    function under Python 3.12+. CFFI does not declare a runtime
    setuptools requirement to avoid an unnecessary dependency for
    projects that do not require it.
  - Drop support for end-of-life Python versions (2.7, 3.6, 3.7).
  - Move project source under src/; a more standard layout that
    also enables CI to more easily catch packaging errors.
  - Move project home to python-cffi/cffi on GitHub.
  - Add support for PEP517 builds; setuptools is now a required
    build dependency.
  - Declare python_requires metadata for Python 3.8+. This allows
    unsupported Pythons to continue using previously released
    sdists and wheels.
  - Add missing calls to PyObject_GC_UnTrack to avoid
    ResourceWarning 15c4b71
- Remove upstreamed patch
  8a3c2c816d789639b49d3ae867213393ed7abdff.patch</changelog>
  <changelog author="Dan &#x10C;erm&#xE1;k &lt;dcermak@suse.com&gt;" date="1709208000">- drop unnecessary buildrequire python-py</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1719748800">- add py313-compat.patch
  py313-use-format-unraisable.patch
  py313-use-hashpointer.patch: add upstream patches for py3.13
  support</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1725105600">- update to 1.17.0:
  * Add support for Python 3.13.
  * In API mode, when you get a function from a C library by writing
    `fn = lib.myfunc`, you get an object of a special type for
    performance reasons, instead of a `&lt;cdata 'C-function-type'&gt;`.
    Before version 1.17 you could only call such objects.
    You could write `ffi.addressof(lib, "myfunc")` in order to get
    a real `&lt;cdata&gt;` object, based on the idea that in these cases
    in C you'd usually write `&amp;myfunc` instead of `myfunc`.  In
    version 1.17, the special object `lib.myfunc` can now be passed
    in many places where CFFI expects
    a regular `&lt;cdata&gt;` object.  For example, you can now pass
    it as a callback to a C function call, or write it inside a C
    structure field of the correct pointer-to-function type, or use
    `ffi.cast()` or `ffi.typeof()` on it.
- drop py313-compat.patch, py313-use-format-unraisable.patch,
  py313-use-hashpointer.patch (upstream)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1728475200">- update to 1.17.1:
  * Fix failing distutils.msvc9compiler imports under Windows (#118).
  * ffibuilder.emit_python_code() and ffibuiler.emit_c_code()
    accept file-like objects (#115).
  * ffiplatform calls are bypassed by ffibuilder.emit_python_code()
    and ffibuilder.emit_c_code() (#81).</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1757851200">- update to 2.0.0:
  * Added support for free threaded CPython (3.14t+ only)
  * Added support for Python 3.14.
  * Dropped support for Python 3.8.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1773662400">- Add patch support-pycparser-3.patch:
  * Support pycparser 3 exception message changes.</changelog>
</package>
<package pkgid="f4657bd1b10793e6698bd39d38daf568122c0852695d380ab24be87b312d517fad255a130548cd3a410ba9436169656b8ff0bef33031bf5e2c0390bda5c6f540" name="python311-cffi" arch="armv7hl">
  <version epoch="0" ver="2.0.0" rel="117.10"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1673006400">- add 8a3c2c816d789639b49d3ae867213393ed7abdff.patch to resolve
  testsuite failures with Python 3.11</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1681387200">- Make calling of %{sle15modernpython} optional.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1682078400">- add sle15_python_module_pythons (jsc#PED-68)</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1696593600">- Clean up the SPEC file</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1696593601">- Upgrade to 1.16.0:
  - Add support for Python 3.12. With the removal of distutils
    from Python 3.12, projects using CFFI features that depend on
    distutils at runtime must add a dependency on setuptools to
    function under Python 3.12+. CFFI does not declare a runtime
    setuptools requirement to avoid an unnecessary dependency for
    projects that do not require it.
  - Drop support for end-of-life Python versions (2.7, 3.6, 3.7).
  - Move project source under src/; a more standard layout that
    also enables CI to more easily catch packaging errors.
  - Move project home to python-cffi/cffi on GitHub.
  - Add support for PEP517 builds; setuptools is now a required
    build dependency.
  - Declare python_requires metadata for Python 3.8+. This allows
    unsupported Pythons to continue using previously released
    sdists and wheels.
  - Add missing calls to PyObject_GC_UnTrack to avoid
    ResourceWarning 15c4b71
- Remove upstreamed patch
  8a3c2c816d789639b49d3ae867213393ed7abdff.patch</changelog>
  <changelog author="Dan &#x10C;erm&#xE1;k &lt;dcermak@suse.com&gt;" date="1709208000">- drop unnecessary buildrequire python-py</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1719748800">- add py313-compat.patch
  py313-use-format-unraisable.patch
  py313-use-hashpointer.patch: add upstream patches for py3.13
  support</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1725105600">- update to 1.17.0:
  * Add support for Python 3.13.
  * In API mode, when you get a function from a C library by writing
    `fn = lib.myfunc`, you get an object of a special type for
    performance reasons, instead of a `&lt;cdata 'C-function-type'&gt;`.
    Before version 1.17 you could only call such objects.
    You could write `ffi.addressof(lib, "myfunc")` in order to get
    a real `&lt;cdata&gt;` object, based on the idea that in these cases
    in C you'd usually write `&amp;myfunc` instead of `myfunc`.  In
    version 1.17, the special object `lib.myfunc` can now be passed
    in many places where CFFI expects
    a regular `&lt;cdata&gt;` object.  For example, you can now pass
    it as a callback to a C function call, or write it inside a C
    structure field of the correct pointer-to-function type, or use
    `ffi.cast()` or `ffi.typeof()` on it.
- drop py313-compat.patch, py313-use-format-unraisable.patch,
  py313-use-hashpointer.patch (upstream)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1728475200">- update to 1.17.1:
  * Fix failing distutils.msvc9compiler imports under Windows (#118).
  * ffibuilder.emit_python_code() and ffibuiler.emit_c_code()
    accept file-like objects (#115).
  * ffiplatform calls are bypassed by ffibuilder.emit_python_code()
    and ffibuilder.emit_c_code() (#81).</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1757851200">- update to 2.0.0:
  * Added support for free threaded CPython (3.14t+ only)
  * Added support for Python 3.14.
  * Dropped support for Python 3.8.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1773662400">- Add patch support-pycparser-3.patch:
  * Support pycparser 3 exception message changes.</changelog>
</package>
<package pkgid="45177d71d6a3c7900ed6a73bbeae22437b741c0bb6732ab5f1887a6a2348c91cc27729cb28c2e2567d6694069d856fb8502b94ed6d847703078d22bdabebf2b6" name="python311-cffi" arch="x86_64">
  <version epoch="0" ver="2.0.0" rel="117.10"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1673006400">- add 8a3c2c816d789639b49d3ae867213393ed7abdff.patch to resolve
  testsuite failures with Python 3.11</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1681387200">- Make calling of %{sle15modernpython} optional.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1682078400">- add sle15_python_module_pythons (jsc#PED-68)</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1696593600">- Clean up the SPEC file</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1696593601">- Upgrade to 1.16.0:
  - Add support for Python 3.12. With the removal of distutils
    from Python 3.12, projects using CFFI features that depend on
    distutils at runtime must add a dependency on setuptools to
    function under Python 3.12+. CFFI does not declare a runtime
    setuptools requirement to avoid an unnecessary dependency for
    projects that do not require it.
  - Drop support for end-of-life Python versions (2.7, 3.6, 3.7).
  - Move project source under src/; a more standard layout that
    also enables CI to more easily catch packaging errors.
  - Move project home to python-cffi/cffi on GitHub.
  - Add support for PEP517 builds; setuptools is now a required
    build dependency.
  - Declare python_requires metadata for Python 3.8+. This allows
    unsupported Pythons to continue using previously released
    sdists and wheels.
  - Add missing calls to PyObject_GC_UnTrack to avoid
    ResourceWarning 15c4b71
- Remove upstreamed patch
  8a3c2c816d789639b49d3ae867213393ed7abdff.patch</changelog>
  <changelog author="Dan &#x10C;erm&#xE1;k &lt;dcermak@suse.com&gt;" date="1709208000">- drop unnecessary buildrequire python-py</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1719748800">- add py313-compat.patch
  py313-use-format-unraisable.patch
  py313-use-hashpointer.patch: add upstream patches for py3.13
  support</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1725105600">- update to 1.17.0:
  * Add support for Python 3.13.
  * In API mode, when you get a function from a C library by writing
    `fn = lib.myfunc`, you get an object of a special type for
    performance reasons, instead of a `&lt;cdata 'C-function-type'&gt;`.
    Before version 1.17 you could only call such objects.
    You could write `ffi.addressof(lib, "myfunc")` in order to get
    a real `&lt;cdata&gt;` object, based on the idea that in these cases
    in C you'd usually write `&amp;myfunc` instead of `myfunc`.  In
    version 1.17, the special object `lib.myfunc` can now be passed
    in many places where CFFI expects
    a regular `&lt;cdata&gt;` object.  For example, you can now pass
    it as a callback to a C function call, or write it inside a C
    structure field of the correct pointer-to-function type, or use
    `ffi.cast()` or `ffi.typeof()` on it.
- drop py313-compat.patch, py313-use-format-unraisable.patch,
  py313-use-hashpointer.patch (upstream)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1728475200">- update to 1.17.1:
  * Fix failing distutils.msvc9compiler imports under Windows (#118).
  * ffibuilder.emit_python_code() and ffibuiler.emit_c_code()
    accept file-like objects (#115).
  * ffiplatform calls are bypassed by ffibuilder.emit_python_code()
    and ffibuilder.emit_c_code() (#81).</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1757851200">- update to 2.0.0:
  * Added support for free threaded CPython (3.14t+ only)
  * Added support for Python 3.14.
  * Dropped support for Python 3.8.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1773662400">- Add patch support-pycparser-3.patch:
  * Support pycparser 3 exception message changes.</changelog>
</package>
<package pkgid="8afc1f141d455ef012f29b88523b245badb6d783879eed60028cccd280f0f2b58283ef07d5d20b9f512434f4f2b4ae3eefa2a1ee4765918aa04f257b8f6049ca" name="python311-cffi-debuginfo" arch="aarch64">
  <version epoch="0" ver="2.0.0" rel="117.10"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1673006400">- add 8a3c2c816d789639b49d3ae867213393ed7abdff.patch to resolve
  testsuite failures with Python 3.11</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1681387200">- Make calling of %{sle15modernpython} optional.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1682078400">- add sle15_python_module_pythons (jsc#PED-68)</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1696593600">- Clean up the SPEC file</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1696593601">- Upgrade to 1.16.0:
  - Add support for Python 3.12. With the removal of distutils
    from Python 3.12, projects using CFFI features that depend on
    distutils at runtime must add a dependency on setuptools to
    function under Python 3.12+. CFFI does not declare a runtime
    setuptools requirement to avoid an unnecessary dependency for
    projects that do not require it.
  - Drop support for end-of-life Python versions (2.7, 3.6, 3.7).
  - Move project source under src/; a more standard layout that
    also enables CI to more easily catch packaging errors.
  - Move project home to python-cffi/cffi on GitHub.
  - Add support for PEP517 builds; setuptools is now a required
    build dependency.
  - Declare python_requires metadata for Python 3.8+. This allows
    unsupported Pythons to continue using previously released
    sdists and wheels.
  - Add missing calls to PyObject_GC_UnTrack to avoid
    ResourceWarning 15c4b71
- Remove upstreamed patch
  8a3c2c816d789639b49d3ae867213393ed7abdff.patch</changelog>
  <changelog author="Dan &#x10C;erm&#xE1;k &lt;dcermak@suse.com&gt;" date="1709208000">- drop unnecessary buildrequire python-py</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1719748800">- add py313-compat.patch
  py313-use-format-unraisable.patch
  py313-use-hashpointer.patch: add upstream patches for py3.13
  support</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1725105600">- update to 1.17.0:
  * Add support for Python 3.13.
  * In API mode, when you get a function from a C library by writing
    `fn = lib.myfunc`, you get an object of a special type for
    performance reasons, instead of a `&lt;cdata 'C-function-type'&gt;`.
    Before version 1.17 you could only call such objects.
    You could write `ffi.addressof(lib, "myfunc")` in order to get
    a real `&lt;cdata&gt;` object, based on the idea that in these cases
    in C you'd usually write `&amp;myfunc` instead of `myfunc`.  In
    version 1.17, the special object `lib.myfunc` can now be passed
    in many places where CFFI expects
    a regular `&lt;cdata&gt;` object.  For example, you can now pass
    it as a callback to a C function call, or write it inside a C
    structure field of the correct pointer-to-function type, or use
    `ffi.cast()` or `ffi.typeof()` on it.
- drop py313-compat.patch, py313-use-format-unraisable.patch,
  py313-use-hashpointer.patch (upstream)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1728475200">- update to 1.17.1:
  * Fix failing distutils.msvc9compiler imports under Windows (#118).
  * ffibuilder.emit_python_code() and ffibuiler.emit_c_code()
    accept file-like objects (#115).
  * ffiplatform calls are bypassed by ffibuilder.emit_python_code()
    and ffibuilder.emit_c_code() (#81).</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1757851200">- update to 2.0.0:
  * Added support for free threaded CPython (3.14t+ only)
  * Added support for Python 3.14.
  * Dropped support for Python 3.8.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1773662400">- Add patch support-pycparser-3.patch:
  * Support pycparser 3 exception message changes.</changelog>
</package>
<package pkgid="1a1531e6d2a14102c8ec49deea8f0bba5955a0932493f7506c39b6c9f3022020df90156bbe1b708485c724e5d7453e16b9ed68c1273163b0eecd74b2c06c4b1e" name="python311-cffi-debuginfo" arch="armv7hl">
  <version epoch="0" ver="2.0.0" rel="117.10"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1673006400">- add 8a3c2c816d789639b49d3ae867213393ed7abdff.patch to resolve
  testsuite failures with Python 3.11</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1681387200">- Make calling of %{sle15modernpython} optional.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1682078400">- add sle15_python_module_pythons (jsc#PED-68)</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1696593600">- Clean up the SPEC file</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1696593601">- Upgrade to 1.16.0:
  - Add support for Python 3.12. With the removal of distutils
    from Python 3.12, projects using CFFI features that depend on
    distutils at runtime must add a dependency on setuptools to
    function under Python 3.12+. CFFI does not declare a runtime
    setuptools requirement to avoid an unnecessary dependency for
    projects that do not require it.
  - Drop support for end-of-life Python versions (2.7, 3.6, 3.7).
  - Move project source under src/; a more standard layout that
    also enables CI to more easily catch packaging errors.
  - Move project home to python-cffi/cffi on GitHub.
  - Add support for PEP517 builds; setuptools is now a required
    build dependency.
  - Declare python_requires metadata for Python 3.8+. This allows
    unsupported Pythons to continue using previously released
    sdists and wheels.
  - Add missing calls to PyObject_GC_UnTrack to avoid
    ResourceWarning 15c4b71
- Remove upstreamed patch
  8a3c2c816d789639b49d3ae867213393ed7abdff.patch</changelog>
  <changelog author="Dan &#x10C;erm&#xE1;k &lt;dcermak@suse.com&gt;" date="1709208000">- drop unnecessary buildrequire python-py</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1719748800">- add py313-compat.patch
  py313-use-format-unraisable.patch
  py313-use-hashpointer.patch: add upstream patches for py3.13
  support</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1725105600">- update to 1.17.0:
  * Add support for Python 3.13.
  * In API mode, when you get a function from a C library by writing
    `fn = lib.myfunc`, you get an object of a special type for
    performance reasons, instead of a `&lt;cdata 'C-function-type'&gt;`.
    Before version 1.17 you could only call such objects.
    You could write `ffi.addressof(lib, "myfunc")` in order to get
    a real `&lt;cdata&gt;` object, based on the idea that in these cases
    in C you'd usually write `&amp;myfunc` instead of `myfunc`.  In
    version 1.17, the special object `lib.myfunc` can now be passed
    in many places where CFFI expects
    a regular `&lt;cdata&gt;` object.  For example, you can now pass
    it as a callback to a C function call, or write it inside a C
    structure field of the correct pointer-to-function type, or use
    `ffi.cast()` or `ffi.typeof()` on it.
- drop py313-compat.patch, py313-use-format-unraisable.patch,
  py313-use-hashpointer.patch (upstream)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1728475200">- update to 1.17.1:
  * Fix failing distutils.msvc9compiler imports under Windows (#118).
  * ffibuilder.emit_python_code() and ffibuiler.emit_c_code()
    accept file-like objects (#115).
  * ffiplatform calls are bypassed by ffibuilder.emit_python_code()
    and ffibuilder.emit_c_code() (#81).</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1757851200">- update to 2.0.0:
  * Added support for free threaded CPython (3.14t+ only)
  * Added support for Python 3.14.
  * Dropped support for Python 3.8.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1773662400">- Add patch support-pycparser-3.patch:
  * Support pycparser 3 exception message changes.</changelog>
</package>
<package pkgid="1a1566989fdf96ba4cac4f395cd17f854bf1383ab4cb8c1d942285c027a3c2e59d3f12c95dff9bb3e0fc78117df21c027c7cffac744f25a3147161484593ff26" name="python311-cffi-debuginfo" arch="x86_64">
  <version epoch="0" ver="2.0.0" rel="117.10"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1673006400">- add 8a3c2c816d789639b49d3ae867213393ed7abdff.patch to resolve
  testsuite failures with Python 3.11</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1681387200">- Make calling of %{sle15modernpython} optional.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1682078400">- add sle15_python_module_pythons (jsc#PED-68)</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1696593600">- Clean up the SPEC file</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1696593601">- Upgrade to 1.16.0:
  - Add support for Python 3.12. With the removal of distutils
    from Python 3.12, projects using CFFI features that depend on
    distutils at runtime must add a dependency on setuptools to
    function under Python 3.12+. CFFI does not declare a runtime
    setuptools requirement to avoid an unnecessary dependency for
    projects that do not require it.
  - Drop support for end-of-life Python versions (2.7, 3.6, 3.7).
  - Move project source under src/; a more standard layout that
    also enables CI to more easily catch packaging errors.
  - Move project home to python-cffi/cffi on GitHub.
  - Add support for PEP517 builds; setuptools is now a required
    build dependency.
  - Declare python_requires metadata for Python 3.8+. This allows
    unsupported Pythons to continue using previously released
    sdists and wheels.
  - Add missing calls to PyObject_GC_UnTrack to avoid
    ResourceWarning 15c4b71
- Remove upstreamed patch
  8a3c2c816d789639b49d3ae867213393ed7abdff.patch</changelog>
  <changelog author="Dan &#x10C;erm&#xE1;k &lt;dcermak@suse.com&gt;" date="1709208000">- drop unnecessary buildrequire python-py</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1719748800">- add py313-compat.patch
  py313-use-format-unraisable.patch
  py313-use-hashpointer.patch: add upstream patches for py3.13
  support</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1725105600">- update to 1.17.0:
  * Add support for Python 3.13.
  * In API mode, when you get a function from a C library by writing
    `fn = lib.myfunc`, you get an object of a special type for
    performance reasons, instead of a `&lt;cdata 'C-function-type'&gt;`.
    Before version 1.17 you could only call such objects.
    You could write `ffi.addressof(lib, "myfunc")` in order to get
    a real `&lt;cdata&gt;` object, based on the idea that in these cases
    in C you'd usually write `&amp;myfunc` instead of `myfunc`.  In
    version 1.17, the special object `lib.myfunc` can now be passed
    in many places where CFFI expects
    a regular `&lt;cdata&gt;` object.  For example, you can now pass
    it as a callback to a C function call, or write it inside a C
    structure field of the correct pointer-to-function type, or use
    `ffi.cast()` or `ffi.typeof()` on it.
- drop py313-compat.patch, py313-use-format-unraisable.patch,
  py313-use-hashpointer.patch (upstream)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1728475200">- update to 1.17.1:
  * Fix failing distutils.msvc9compiler imports under Windows (#118).
  * ffibuilder.emit_python_code() and ffibuiler.emit_c_code()
    accept file-like objects (#115).
  * ffiplatform calls are bypassed by ffibuilder.emit_python_code()
    and ffibuilder.emit_c_code() (#81).</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1757851200">- update to 2.0.0:
  * Added support for free threaded CPython (3.14t+ only)
  * Added support for Python 3.14.
  * Dropped support for Python 3.8.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1773662400">- Add patch support-pycparser-3.patch:
  * Support pycparser 3 exception message changes.</changelog>
</package>
<package pkgid="8ba454efd82ae72c10ab1e59c95fba0b7182f398efb086928dfbfaf0554f076a5891d015548a496b7427a52dd5c91b8fcc013c12c4c3da84a970012394de7d6e" name="python311-cryptography" arch="aarch64">
  <version epoch="0" ver="49.0.0" rel="289.3"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1727524800">- update to 43.0.1:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.3.2.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1729598400">- update to 43.0.3:
  * Fixed release metadata for cryptography-vectors
  * Fixed compilation when using LibreSSL 4.0.0.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1730808000">- Avoid using requires_eq, which after the last modifications
  conflicts with python singlespec (order of expansion).</changelog>
  <changelog author="Ben Greiner &lt;code@bnavigator.de&gt;" date="1731067200">- Fix requires_eq replacement for distributions which do not have
  python3-cffi installed (such as SLE15 python module pythons)
  * gh#openSUSE/python-rpm-macros#185
- Remove outdated section in description</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfyhalomacro@opensuse.org&gt;" date="1737892800">- Update to version 44.0.0:
  * BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL &lt; 3.9.
  * Deprecated Python 3.7 support. Python 3.7 is no longer supported by
    the Python core team. Support for Python 3.7 will be removed in a future
    cryptography release.
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.4.0.
  * macOS wheels are now built against the macOS 10.13 SDK. Users on older
    versions of macOS should upgrade, or they will need to build cryptography
    themselves.
  * Enforce the RFC 5280 requirement that extended key usage extensions must not be empty.
  * Added support for timestamp extraction to the :class:`~cryptography.fernet.MultiFernet` class.
  * Relax the Authority Key Identifier requirements on root CA certificates
    during X.509 verification to allow fields permitted by RFC 5280 but
    forbidden by the CA/Browser BRs.
  * Added support for
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2id` when using
    OpenSSL 3.2.0+.
  * Added support for the :class:`~cryptography.x509.Admissions` certificate extension.
  * Added basic support for PKCS7 decryption (including S/MIME 3.2) via
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der`,
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_pem`,
    and :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_smime`.
- Update specfile to accommodate new project structure at version 44.0.0
- Update no-pytest_benchmark.patch</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1740571200">- update to 44.0.1:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.4.1.
  * We now build armv7l manylinux wheels and publish them to
    PyPI.
  * We now build manylinux_2_34 wheels and publish them to PyPI.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1742731200">- update to 44.0.2:
  * We now build wheels for PyPy 3.11.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1746619200">- Update to 44.0.3
  * Fixed compilation when using LibreSSL 4.1.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1752321600">- update to 45.0.5:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.1.
  * Fixed decrypting PKCS#8 files encrypted with SHA1-RC4. (This
    is not considered secure, and is supported only for backwards
    compatibility.)
  * Fixed decrypting PKCS#8 files encrypted with long salts (this
    impacts keys encrypted by Bouncy Castle).
  * Fixed decrypting PKCS#8 files encrypted with DES-CBC-MD5.
    While wildly insecure, this remains prevalent.
  * Fixed using mypy with cryptography on older versions of
    Python.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.0.
  * Support for Python 3.7 is deprecated and will be removed in
    the next cryptography release.
  * Updated the minimum supported Rust version (MSRV) to 1.74.0,
    from 1.65.0.
  * Added support for serialization of PKCS#12 Java truststores
    in :func:`~cryptography.hazmat.primitives.serialization.pkcs1
    2.serialize_java_truststore`
  * Added :meth:`~cryptography.hazmat.primitives.kdf.argon2.Argon
    2id.derive_phc_encoded` and :meth:`~cryptography.hazmat.primi
    tives.kdf.argon2.Argon2id.verify_phc_encoded` methods to
    support password hashing in the PHC string format
  * Added support for PKCS7 decryption and encryption using
    AES-256 as the content algorithm, in addition to AES-128.
  * BACKWARDS INCOMPATIBLE: Made SSH private key loading more
    consistent with other private key loading: :func:`~cryptograp
    hy.hazmat.primitives.serialization.load_ssh_private_key` now
    raises a TypeError if the key is unencrypted but a password
    is provided (previously no exception was raised), and raises
    a TypeError if the key is encrypted but no password is
    provided (previously a ValueError was raised).
  * Added __copy__ to the :class:`~cryptography.hazmat.primitives
    .asymmetric.ec.EllipticCurvePrivateKey`, :class:`~cryptograph
    y.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey`, :c
    lass:`~cryptography.hazmat.primitives.asymmetric.ed25519.Ed25
    519PublicKey`, :class:`~cryptography.hazmat.primitives.asymme
    tric.ed25519.Ed25519PrivateKey`, :class:`~cryptography.hazmat
    .primitives.asymmetric.ed448.Ed448PublicKey`, :class:`~crypto
    graphy.hazmat.primitives.asymmetric.ed448.Ed448PrivateKey`, :
    class:`~cryptography.hazmat.primitives.asymmetric.x25519.X255
    19PublicKey`, :class:`~cryptography.hazmat.primitives.asymmet
    ric.x25519.X25519PrivateKey`, :class:`~cryptography.hazmat.pr
    imitives.asymmetric.x448.X448PublicKey`, :class:`~cryptograph
    y.hazmat.primitives.asymmetric.x448.X448PrivateKey`, :class:`
    ~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey`
    , :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAP
    ublicKey`, :class:`~cryptography.hazmat.primitives.asymmetric
    .dsa.DSAPrivateKey`, :class:`~cryptography.hazmat.primitives.
    asymmetric.dsa.DSAPublicKey`, :class:`~cryptography.hazmat.pr
    imitives.asymmetric.dh.DHPrivateKey`, and :class:`~cryptograp
    hy.hazmat.primitives.asymmetric.dh.DHPublicKey` abstract base
    classes.
  * We significantly refactored how private key loading ( :func:`
    ~cryptography.hazmat.primitives.serialization.load_pem_privat
    e_key` and :func:`~cryptography.hazmat.primitives.serializati
    on.load_der_private_key`) works. This is intended to be
    backwards compatible for all well-formed keys, therefore if
    you discover a key that now raises an exception, please file
    a bug with instructions for reproducing.
  * Added unsafe_skip_rsa_key_validation keyword-argument to :fun
    c:`~cryptography.hazmat.primitives.serialization.load_ssh_pri
    vate_key`.
  * Added :class:`~cryptography.hazmat.primitives.hashes.XOFHash`
    to support repeated :meth:`~cryptography.hazmat.primitives.ha
    shes.XOFHash.squeeze` operations on extendable output
    functions.
  * Added :meth:`~cryptography.x509.ocsp.OCSPResponseBuilder.add_
    response_by_hash` method to allow creating OCSP responses
    using certificate hash values rather than full certificates.
  * Extended the :mod:`X.509 path validation
    &lt;cryptography.x509.verification&gt;` API to support user-
    configured extension policies via the
    :meth:`PolicyBuilder.extension_policies &lt;cryptography.x509.ve
    rification.PolicyBuilder.extension_policies&gt;` method.
  * Deprecated the subject, verification_time and max_chain_depth
    properties on
    :class:`~cryptography.x509.verification.ClientVerifier` and
    :class:`~cryptography.x509.verification.ServerVerifier` in
    favor of a new policy property. These properties will be
    removed in the next release of cryptography.
  * BACKWARDS INCOMPATIBLE: The :meth:`VerifiedClient.subject
    &lt;cryptography.x509.verification.VerifiedClient.subjects&gt;`
    property can now be None since a custom extension policy may
    allow certificates without a Subject Alternative Name
    extension.
  * Changed the behavior when the OpenSSL 3 legacy provider fails
    to load. Instead of raising an exception, a warning is now
    emitted. The CRYPTOGRAPHY_OPENSSL_NO_LEGACY environment
    variable can still be used to disable the legacy provider at
    runtime.
  * Added support for the CRYPTOGRAPHY_BUILD_OPENSSL_NO_LEGACY
    environment variable during build time, which prevents the
    library from ever attempting to load the legacy provider.
  * Added support for the
    :class:`~cryptography.x509.PrivateKeyUsagePeriod` X.509
    extension. This extension defines the period during which the
    private key corresponding to the certificate's public key may
    be used.
  * Added support for compiling against `aws-lc`_.
  * Parsing X.509 structures now more strictly enforces that Name
    structures do not have malformed ASN.1.
  * We now publish py311 wheels that utilize the faster
    pyo3::buffer::PyBuffer interface, resulting in significantly
    improved performance for operations involving small buffers.
  * Added :func:`~cryptography.hazmat.primitives.serialization.ss
    h_key_fingerprint` for computing fingerprints of SSH public
    keys.
  * Added support for deterministic ECDSA signing via the new
    keyword-only argument ecdsa_deterministic in
    :meth:`~cryptography.x509.CertificateBuilder.sign`, :meth:`~c
    ryptography.x509.CertificateRevocationListBuilder.sign` and :
    meth:`~cryptography.x509.CertificateSigningRequestBuilder.sig
    n`.</changelog>
  <changelog author="James Oakley &lt;jfunk@opensuse.org&gt;" date="1756728000">- Add Make-unsafe-subinterpreter-support-available-via-cfg.patch
  to allow ceph-mgr to load modules (boo#1248987)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1757851200">- update to 45.0.7:
  * Added a function to support an upcoming pyOpenSSL release.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1760356800">- update to 46.0.2:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.4.
  * Fixed an issue where users installing via pip on Python 3.14
    development versions would not properly install a dependency.
  * Fixed an issue building the free-threaded macOS 3.14 wheels.
  * BACKWARDS INCOMPATIBLE: Support for Python 3.7 has been
    removed.
  * Support for OpenSSL &lt; 3.0 is deprecated and will be removed
    in the next release.
  * Support for x86_64 macOS (including publishing wheels) is
    deprecated and will be removed in two releases. We will
    switch to publishing an arm64 only wheel for macOS.
  * Support for 32-bit Windows (including publishing wheels) is
    deprecated and will be removed in two releases. Users should
    move to a 64-bit Python installation.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.3.
  * We now build ppc64le manylinux wheels and publish them to
    PyPI.
  * We now build win_arm64 (Windows on Arm) wheels and publish
    them to PyPI.
  * Added support for free-threaded Python 3.14.
  * Removed the deprecated get_attribute_for_oid method on
    :class:`~cryptography.x509.CertificateSigningRequest`. Users
    should use
    :meth:`~cryptography.x509.Attributes.get_attribute_for_oid`
    instead.
  * Removed the deprecated CAST5, SEED, IDEA, and Blowfish
    classes from the cipher module. These are still available in
    :doc:`/hazmat/decrepit/index`.
  * In X.509, when performing a PSS signature with a SHA-3 hash,
    it is now encoded with the official NIST SHA3 OID.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1765195200">- Only require pytest-subtests with pytest &lt; 9.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1770897600">- Update to 46.0.5 (fixes CVE-2026-26007, bsc#1258074)
  * An attacker could create a malicious public key that reveals portions of
    your private key when using certain uncommon elliptic curves (binary
    curves). This version now includes additional security checks to prevent
    this attack. This issue only affects binary elliptic curves, which are
    rarely used in real-world applications. Credit to XlabAI Team of Tencent
    Xuanwu Lab and Atuin Automated Vulnerability Discovery Engine for reporting
    the issue. CVE-2026-26007
  * Support for SECT* binary elliptic curves is deprecated and will be removed
    in the next release.
- Update to 46.0.4
  * Dropped support for win_arm64 wheels.
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.5.
- Update to 46.0.3
  * Fixed compilation when using LibreSSL 4.2.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1774612800">- update to 46.0.6 (CVE-2026-34073, bsc#1260876):
  * SECURITY ISSUE: Fixed a bug where name constraints were not
    applied to peer names during verification when the leaf
    certificate contains a wildcard DNS SAN. Ordinary X.509
    topologies are not affected by this bug, including those used
    by the Web PKI. Credit to Oleh Konko (1seal) for reporting
    the issue. CVE-2026-34073</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1774958400">- Add patch support-maturin-1.12.patch:
  * Correctly deal with maturin bugfix that installs tests and
    docs under sitearch.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1775822400">- Update to 46.0.7 (fixes CVE-2026-39892, bsc#1261863)
  * **SECURITY ISSUE**: Fixed an issue where non-contiguous buffers could be
    passed to APIs that accept Python buffers, which could lead to buffer
    overflow. **CVE-2026-39892**
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.6.
- drop support-maturin-1.12.patch (upstream)
- drop no-pytest_benchmark.patch,
  Make-unsafe-subinterpreter-support-available-via-cfg.patch:
  obsolete</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1777204800">- update to 47.0.0:
  * Support for Python 3.8 is deprecated and will be removed in
    the next cryptography release.
  * BACKWARDS INCOMPATIBLE: Support for binary elliptic curves
    (SECT* classes) has been removed. These curves are rarely
    used and have additional security considerations that make
    them undesirable.
  * BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.1.x has been
    removed. OpenSSL 3.0.0 or later is now required. LibreSSL,
    BoringSSL, and AWS-LC continue to be supported.
  * BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL &lt; 4.1.
  * BACKWARDS INCOMPATIBLE: Loading keys with unsupported
    algorithms or keys with unsupported explicit curve encodings
    now raises
    :class:`~cryptography.exceptions.UnsupportedAlgorithm`
    instead of ValueError. This change affects :func:`~cryptograp
    hy.hazmat.primitives.serialization.load_pem_private_key`, :fu
    nc:`~cryptography.hazmat.primitives.serialization.load_der_pr
    ivate_key`, :func:`~cryptography.hazmat.primitives.serializat
    ion.load_pem_public_key`, :func:`~cryptography.hazmat.primiti
    ves.serialization.load_der_public_key`, and
    :meth:`~cryptography.x509.Certificate.public_key` when called
    on certificates with unsupported public key algorithms.
  * BACKWARDS INCOMPATIBLE: When parsing elliptic curve private
    keys, we now reject keys that incorrectly encode a private
    key of the wrong length because such keys are impossible to
    process in a constant-time manner. We do not believe keys
    with this problem are in wide use, however we may revert this
    change based on the feedback we receive.
  * Deprecated passing 64-bit (8-byte) and 128-bit (16-byte) keys
    to :class:`~cryptography.hazmat.decrepit.ciphers.algorithms.T
    ripleDES`. In a future release, only 192-bit (24-byte) keys
    will be accepted. Users should expand shorter keys themselves
    (e.g., for single DES: key + key + key, for two-key: key +
    key[:8]).
  * Updated the minimum supported Rust version (MSRV) to 1.83.0,
    from 1.74.0.
  * Support for x86_64 macOS (including publishing wheels) is
    deprecated and will be removed in the next release. We will
    switch to publishing an arm64 only wheel for macOS.
  * Support for 32-bit Windows (including publishing wheels) is
    deprecated and will be removed in the next release. Users
    should move to a 64-bit Python installation.
  * public_bytes and private_bytes methods on keys now raise
    TypeError (instead of ValueError) if an invalid encoding is
    provided for the given format.
  * Moved
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.CFB`,
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.OFB`, and
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.CFB8`
    into :doc:`/hazmat/decrepit/index` and deprecated them in the
    modes module. They will be removed from the modes module in
    49.0.0.
  * Moved :class:`~cryptography.hazmat.primitives.ciphers.algorit
    hms.Camellia` into  :doc:`/hazmat/decrepit/index` and
    deprecated it in the cipher module. It will be removed from
    the cipher module in 49.0.0.
  * Added
    :meth:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF.extract`
    to :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF`.
    The previous private implementation will be removed in
    49.0.0.
  * Added support for loading elliptic curve keys that contain
    explicit encodings of the curves secp256r1, secp384r1, and
    secp521r1.
  * Added support for
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2d`
    and
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2i`
    when using OpenSSL 3.2.0+.
  * Added derive_into methods to
    :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF`,
    :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDFExpand`,
    :class:`~cryptography.hazmat.primitives.kdf.concatkdf.ConcatK
    DFHash`, :class:`~cryptography.hazmat.primitives.kdf.concatkd
    f.ConcatKDFHMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2id`,
    :class:`~cryptography.hazmat.primitives.kdf.pbkdf2.PBKDF2HMAC
    `,
    :class:`~cryptography.hazmat.primitives.kdf.kbkdf.KBKDFHMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.kbkdf.KBKDFCMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.scrypt.Scrypt`,
    and
    :class:`~cryptography.hazmat.primitives.kdf.x963kdf.X963KDF`
    to allow deriving keys directly into pre-allocated buffers.
  * Added encrypt_into and decrypt_into methods to
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESCCM`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESGCM`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESGCMSI
    V`, :class:`~cryptography.hazmat.primitives.ciphers.aead.AESO
    CB3`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESSIV`,
    and :class:`~cryptography.hazmat.primitives.ciphers.aead.ChaC
    ha20Poly1305` to allow encrypting directly into a pre-
    allocated buffer.
  * Added support for PKCS1v15 signing without DigestInfo using :
    class:`~cryptography.hazmat.primitives.asymmetric.utils.NoDig
    estInfo`.
  * Added
    :meth:`~cryptography.hazmat.primitives.hashes.Hash.hash`, a
    one-shot method for computing hashes.
  * Added :doc:`/hazmat/primitives/hpke` support implementing RFC
    9180 for hybrid authenticated encryption.
  * Added new :doc:`/hazmat/primitives/asymmetric/mlkem` module
    with support for ML-KEM key encapsulation with AWS-LC and
    BoringSSL. Note: Post-quantum algorithm support requires AWS-
    LC or BoringSSL. As we ship our wheels with OpenSSL, most
    users will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Note: Post-quantum algorithm support requires AWS-LC or
    BoringSSL. As we ship our wheels with OpenSSL, most users
    will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Added new :doc:`/hazmat/primitives/asymmetric/mldsa` module
    with support for ML-DSA signing and verification with AWS-LC
    and BoringSSL. Note: Post-quantum algorithm support requires
    AWS-LC or BoringSSL. As we ship our wheels with OpenSSL, most
    users will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Note: Post-quantum algorithm support requires AWS-LC or
    BoringSSL. As we ship our wheels with OpenSSL, most users
    will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Added new :doc:`/hazmat/asn1/index` module with support for
    declaratively defining custom ASN.1 types and
    encoding/decoding them.
  * Fixed compilation when using LibreSSL 4.3.0 and OpenSSL
    4.0.0.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 4.0.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1778414400">- update to 48.0.0:
  * BACKWARDS INCOMPATIBLE: Support for Python 3.8 has been
    removed. cryptography now requires Python 3.9 or later.
  * BACKWARDS INCOMPATIBLE: Loading an X.509 CRL whose inner
    TBSCertList.signature algorithm does not match the outer
    signatureAlgorithm now raises ValueError. Previously, such
    CRLs were parsed successfully and only rejected during
    signature validation.
  * Added support for :doc:`/hazmat/primitives/asymmetric/mlkem`
    and :doc:`/hazmat/primitives/asymmetric/mldsa` when using
    OpenSSL 3.5.0 or later, in addition to the existing AWS-LC
    and BoringSSL support. This means post-quantum algorithms are
    now available to users of our wheels. Note: Going forward, we
    do not guarantee that all functionality in cryptography will
    be available when building against OpenSSL. See
    :doc:`/statements/state-of-openssl` for more information.
  * Note: Going forward, we do not guarantee that all
    functionality in cryptography will be available when building
    against OpenSSL. See :doc:`/statements/state-of-openssl` for
    more information.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1781438400">- update to 49.0.0:
  * BACKWARDS INCOMPATIBLE: Removed the deprecated
    PUBLIC_KEY_TYPES, PRIVATE_KEY_TYPES,
    CERTIFICATE_PRIVATE_KEY_TYPES,
    CERTIFICATE_ISSUER_PUBLIC_KEY_TYPES, and
    CERTIFICATE_PUBLIC_KEY_TYPES type aliases. Use
    PublicKeyTypes, PrivateKeyTypes,
    CertificateIssuerPrivateKeyTypes,
    CertificateIssuerPublicKeyTypes, and
    CertificatePublicKeyTypes instead. These were deprecated in
    version 40.0.
  * BACKWARDS INCOMPATIBLE: :class:`~cryptography.hazmat.primitiv
    es.ciphers.algorithms.ChaCha20` now treats the first 4 bytes
    of the nonce as a 32-bit little-endian block counter (as
    defined in RFC 7539) and tracks the number of bytes
    processed. Attempting to encrypt or decrypt more data than
    the counter allows before it would overflow now raises a
    :class:`ValueError` rather than silently diverging from RFC
    7539. Setting the counter portion of the nonce to zero allows
    encrypting up to 256 GiB with a given nonce.
  * BACKWARDS INCOMPATIBLE: Loading an X.509 certificate whose
    ECDSA or DSA signature AlgorithmIdentifier contains encoded
    NULL parameters now raises a :class:`ValueError`. Such
    certificates are invalid, but older versions of Java emitted
    them; previously they loaded with a deprecation warning.
  * Fixed cross-compilation of the CFFI bindings when
    PYO3_CROSS_LIB_DIR is set. The build now derives the Python
    include directory from PYO3_CROSS_LIB_DIR instead of querying
    the host interpreter, which previously caused the build to
    fail during cross-compilations for embedded systems, on hosts
    which have same-version Python development headers installed
    as the target Python.
  * Added support for signing and verifying X.509 certificates,
    certificate signing requests, and certificate revocation
    lists with :doc:`/hazmat/primitives/asymmetric/mldsa` keys,
    as well as loading certificates that contain ML-DSA public
    keys.
  * Added
    :meth:`~cryptography.hazmat.primitives.hpke.KEM.enc_length`
    to :class:`~cryptography.hazmat.primitives.hpke.KEM` so
    callers can split the encapsulated key from the ciphertext
    returned by
    :meth:`~cryptography.hazmat.primitives.hpke.Suite.encrypt`.
  * :meth:`~cryptography.x509.verification.ExtensionPolicy.requir
    e_present`, :meth:`~cryptography.x509.verification.ExtensionP
    olicy.may_be_present`, and :meth:`~cryptography.x509.verifica
    tion.ExtensionPolicy.require_not_present` now accept any
    extension type. Previously only a fixed set of extension
    types was supported, which made it impossible to account for
    otherwise unrecognized critical extensions during path
    validation.
  * Added support for using
    :class:`~cryptography.x509.Certificate`,
    :class:`~cryptography.x509.CertificateSigningRequest`, and
    :class:`~cryptography.x509.CertificateRevocationList` as
    field types in :doc:`/hazmat/asn1/index` structures.
  * Added :func:`~cryptography.hazmat.asn1.value_set`, a class
    decorator that registers an :class:`enum.Enum` subclass as an
    ASN.1 value set: members are encoded as their underlying
    value, and decoding fails if the decoded value does not match
    one of the declared members.
  * Added :meth:`~cryptography.x509.Name.from_bytes` for parsing
    a :class:`~cryptography.x509.Name` from DER bytes, the
    inverse of :meth:`~cryptography.x509.Name.public_bytes`.
  * Added the rsa_padding keyword-only parameter to
    :meth:`~cryptography.x509.CertificateBuilder.public_key`.
    Passing the :class:`~cryptography.hazmat.primitives.asymmetri
    c.padding.PSS` class (not an instance) encodes an RSA subject
    public key in the certificate's subjectPublicKeyInfo with the
    id-RSASSA-PSS OID and no parameters.
  * Added external mu (message representative) support to
    :doc:`/hazmat/primitives/asymmetric/mldsa` via the sign_mu
    and verify_mu methods, which sign and verify a precomputed
    64-byte mu as defined in FIPS 204.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 4.0.1.</changelog>
</package>
<package pkgid="245fd782f684045ca1a85d4e6f7869dfa1b06f9ee4fa6deb767279c982da003d4c5a80a4b3a1d99f3a739490f20d197a4e56ceaf7ae4cca7cb685f9970a58102" name="python311-cryptography" arch="armv7hl">
  <version epoch="0" ver="49.0.0" rel="289.3"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1727524800">- update to 43.0.1:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.3.2.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1729598400">- update to 43.0.3:
  * Fixed release metadata for cryptography-vectors
  * Fixed compilation when using LibreSSL 4.0.0.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1730808000">- Avoid using requires_eq, which after the last modifications
  conflicts with python singlespec (order of expansion).</changelog>
  <changelog author="Ben Greiner &lt;code@bnavigator.de&gt;" date="1731067200">- Fix requires_eq replacement for distributions which do not have
  python3-cffi installed (such as SLE15 python module pythons)
  * gh#openSUSE/python-rpm-macros#185
- Remove outdated section in description</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfyhalomacro@opensuse.org&gt;" date="1737892800">- Update to version 44.0.0:
  * BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL &lt; 3.9.
  * Deprecated Python 3.7 support. Python 3.7 is no longer supported by
    the Python core team. Support for Python 3.7 will be removed in a future
    cryptography release.
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.4.0.
  * macOS wheels are now built against the macOS 10.13 SDK. Users on older
    versions of macOS should upgrade, or they will need to build cryptography
    themselves.
  * Enforce the RFC 5280 requirement that extended key usage extensions must not be empty.
  * Added support for timestamp extraction to the :class:`~cryptography.fernet.MultiFernet` class.
  * Relax the Authority Key Identifier requirements on root CA certificates
    during X.509 verification to allow fields permitted by RFC 5280 but
    forbidden by the CA/Browser BRs.
  * Added support for
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2id` when using
    OpenSSL 3.2.0+.
  * Added support for the :class:`~cryptography.x509.Admissions` certificate extension.
  * Added basic support for PKCS7 decryption (including S/MIME 3.2) via
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der`,
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_pem`,
    and :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_smime`.
- Update specfile to accommodate new project structure at version 44.0.0
- Update no-pytest_benchmark.patch</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1740571200">- update to 44.0.1:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.4.1.
  * We now build armv7l manylinux wheels and publish them to
    PyPI.
  * We now build manylinux_2_34 wheels and publish them to PyPI.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1742731200">- update to 44.0.2:
  * We now build wheels for PyPy 3.11.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1746619200">- Update to 44.0.3
  * Fixed compilation when using LibreSSL 4.1.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1752321600">- update to 45.0.5:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.1.
  * Fixed decrypting PKCS#8 files encrypted with SHA1-RC4. (This
    is not considered secure, and is supported only for backwards
    compatibility.)
  * Fixed decrypting PKCS#8 files encrypted with long salts (this
    impacts keys encrypted by Bouncy Castle).
  * Fixed decrypting PKCS#8 files encrypted with DES-CBC-MD5.
    While wildly insecure, this remains prevalent.
  * Fixed using mypy with cryptography on older versions of
    Python.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.0.
  * Support for Python 3.7 is deprecated and will be removed in
    the next cryptography release.
  * Updated the minimum supported Rust version (MSRV) to 1.74.0,
    from 1.65.0.
  * Added support for serialization of PKCS#12 Java truststores
    in :func:`~cryptography.hazmat.primitives.serialization.pkcs1
    2.serialize_java_truststore`
  * Added :meth:`~cryptography.hazmat.primitives.kdf.argon2.Argon
    2id.derive_phc_encoded` and :meth:`~cryptography.hazmat.primi
    tives.kdf.argon2.Argon2id.verify_phc_encoded` methods to
    support password hashing in the PHC string format
  * Added support for PKCS7 decryption and encryption using
    AES-256 as the content algorithm, in addition to AES-128.
  * BACKWARDS INCOMPATIBLE: Made SSH private key loading more
    consistent with other private key loading: :func:`~cryptograp
    hy.hazmat.primitives.serialization.load_ssh_private_key` now
    raises a TypeError if the key is unencrypted but a password
    is provided (previously no exception was raised), and raises
    a TypeError if the key is encrypted but no password is
    provided (previously a ValueError was raised).
  * Added __copy__ to the :class:`~cryptography.hazmat.primitives
    .asymmetric.ec.EllipticCurvePrivateKey`, :class:`~cryptograph
    y.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey`, :c
    lass:`~cryptography.hazmat.primitives.asymmetric.ed25519.Ed25
    519PublicKey`, :class:`~cryptography.hazmat.primitives.asymme
    tric.ed25519.Ed25519PrivateKey`, :class:`~cryptography.hazmat
    .primitives.asymmetric.ed448.Ed448PublicKey`, :class:`~crypto
    graphy.hazmat.primitives.asymmetric.ed448.Ed448PrivateKey`, :
    class:`~cryptography.hazmat.primitives.asymmetric.x25519.X255
    19PublicKey`, :class:`~cryptography.hazmat.primitives.asymmet
    ric.x25519.X25519PrivateKey`, :class:`~cryptography.hazmat.pr
    imitives.asymmetric.x448.X448PublicKey`, :class:`~cryptograph
    y.hazmat.primitives.asymmetric.x448.X448PrivateKey`, :class:`
    ~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey`
    , :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAP
    ublicKey`, :class:`~cryptography.hazmat.primitives.asymmetric
    .dsa.DSAPrivateKey`, :class:`~cryptography.hazmat.primitives.
    asymmetric.dsa.DSAPublicKey`, :class:`~cryptography.hazmat.pr
    imitives.asymmetric.dh.DHPrivateKey`, and :class:`~cryptograp
    hy.hazmat.primitives.asymmetric.dh.DHPublicKey` abstract base
    classes.
  * We significantly refactored how private key loading ( :func:`
    ~cryptography.hazmat.primitives.serialization.load_pem_privat
    e_key` and :func:`~cryptography.hazmat.primitives.serializati
    on.load_der_private_key`) works. This is intended to be
    backwards compatible for all well-formed keys, therefore if
    you discover a key that now raises an exception, please file
    a bug with instructions for reproducing.
  * Added unsafe_skip_rsa_key_validation keyword-argument to :fun
    c:`~cryptography.hazmat.primitives.serialization.load_ssh_pri
    vate_key`.
  * Added :class:`~cryptography.hazmat.primitives.hashes.XOFHash`
    to support repeated :meth:`~cryptography.hazmat.primitives.ha
    shes.XOFHash.squeeze` operations on extendable output
    functions.
  * Added :meth:`~cryptography.x509.ocsp.OCSPResponseBuilder.add_
    response_by_hash` method to allow creating OCSP responses
    using certificate hash values rather than full certificates.
  * Extended the :mod:`X.509 path validation
    &lt;cryptography.x509.verification&gt;` API to support user-
    configured extension policies via the
    :meth:`PolicyBuilder.extension_policies &lt;cryptography.x509.ve
    rification.PolicyBuilder.extension_policies&gt;` method.
  * Deprecated the subject, verification_time and max_chain_depth
    properties on
    :class:`~cryptography.x509.verification.ClientVerifier` and
    :class:`~cryptography.x509.verification.ServerVerifier` in
    favor of a new policy property. These properties will be
    removed in the next release of cryptography.
  * BACKWARDS INCOMPATIBLE: The :meth:`VerifiedClient.subject
    &lt;cryptography.x509.verification.VerifiedClient.subjects&gt;`
    property can now be None since a custom extension policy may
    allow certificates without a Subject Alternative Name
    extension.
  * Changed the behavior when the OpenSSL 3 legacy provider fails
    to load. Instead of raising an exception, a warning is now
    emitted. The CRYPTOGRAPHY_OPENSSL_NO_LEGACY environment
    variable can still be used to disable the legacy provider at
    runtime.
  * Added support for the CRYPTOGRAPHY_BUILD_OPENSSL_NO_LEGACY
    environment variable during build time, which prevents the
    library from ever attempting to load the legacy provider.
  * Added support for the
    :class:`~cryptography.x509.PrivateKeyUsagePeriod` X.509
    extension. This extension defines the period during which the
    private key corresponding to the certificate's public key may
    be used.
  * Added support for compiling against `aws-lc`_.
  * Parsing X.509 structures now more strictly enforces that Name
    structures do not have malformed ASN.1.
  * We now publish py311 wheels that utilize the faster
    pyo3::buffer::PyBuffer interface, resulting in significantly
    improved performance for operations involving small buffers.
  * Added :func:`~cryptography.hazmat.primitives.serialization.ss
    h_key_fingerprint` for computing fingerprints of SSH public
    keys.
  * Added support for deterministic ECDSA signing via the new
    keyword-only argument ecdsa_deterministic in
    :meth:`~cryptography.x509.CertificateBuilder.sign`, :meth:`~c
    ryptography.x509.CertificateRevocationListBuilder.sign` and :
    meth:`~cryptography.x509.CertificateSigningRequestBuilder.sig
    n`.</changelog>
  <changelog author="James Oakley &lt;jfunk@opensuse.org&gt;" date="1756728000">- Add Make-unsafe-subinterpreter-support-available-via-cfg.patch
  to allow ceph-mgr to load modules (boo#1248987)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1757851200">- update to 45.0.7:
  * Added a function to support an upcoming pyOpenSSL release.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1760356800">- update to 46.0.2:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.4.
  * Fixed an issue where users installing via pip on Python 3.14
    development versions would not properly install a dependency.
  * Fixed an issue building the free-threaded macOS 3.14 wheels.
  * BACKWARDS INCOMPATIBLE: Support for Python 3.7 has been
    removed.
  * Support for OpenSSL &lt; 3.0 is deprecated and will be removed
    in the next release.
  * Support for x86_64 macOS (including publishing wheels) is
    deprecated and will be removed in two releases. We will
    switch to publishing an arm64 only wheel for macOS.
  * Support for 32-bit Windows (including publishing wheels) is
    deprecated and will be removed in two releases. Users should
    move to a 64-bit Python installation.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.3.
  * We now build ppc64le manylinux wheels and publish them to
    PyPI.
  * We now build win_arm64 (Windows on Arm) wheels and publish
    them to PyPI.
  * Added support for free-threaded Python 3.14.
  * Removed the deprecated get_attribute_for_oid method on
    :class:`~cryptography.x509.CertificateSigningRequest`. Users
    should use
    :meth:`~cryptography.x509.Attributes.get_attribute_for_oid`
    instead.
  * Removed the deprecated CAST5, SEED, IDEA, and Blowfish
    classes from the cipher module. These are still available in
    :doc:`/hazmat/decrepit/index`.
  * In X.509, when performing a PSS signature with a SHA-3 hash,
    it is now encoded with the official NIST SHA3 OID.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1765195200">- Only require pytest-subtests with pytest &lt; 9.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1770897600">- Update to 46.0.5 (fixes CVE-2026-26007, bsc#1258074)
  * An attacker could create a malicious public key that reveals portions of
    your private key when using certain uncommon elliptic curves (binary
    curves). This version now includes additional security checks to prevent
    this attack. This issue only affects binary elliptic curves, which are
    rarely used in real-world applications. Credit to XlabAI Team of Tencent
    Xuanwu Lab and Atuin Automated Vulnerability Discovery Engine for reporting
    the issue. CVE-2026-26007
  * Support for SECT* binary elliptic curves is deprecated and will be removed
    in the next release.
- Update to 46.0.4
  * Dropped support for win_arm64 wheels.
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.5.
- Update to 46.0.3
  * Fixed compilation when using LibreSSL 4.2.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1774612800">- update to 46.0.6 (CVE-2026-34073, bsc#1260876):
  * SECURITY ISSUE: Fixed a bug where name constraints were not
    applied to peer names during verification when the leaf
    certificate contains a wildcard DNS SAN. Ordinary X.509
    topologies are not affected by this bug, including those used
    by the Web PKI. Credit to Oleh Konko (1seal) for reporting
    the issue. CVE-2026-34073</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1774958400">- Add patch support-maturin-1.12.patch:
  * Correctly deal with maturin bugfix that installs tests and
    docs under sitearch.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1775822400">- Update to 46.0.7 (fixes CVE-2026-39892, bsc#1261863)
  * **SECURITY ISSUE**: Fixed an issue where non-contiguous buffers could be
    passed to APIs that accept Python buffers, which could lead to buffer
    overflow. **CVE-2026-39892**
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.6.
- drop support-maturin-1.12.patch (upstream)
- drop no-pytest_benchmark.patch,
  Make-unsafe-subinterpreter-support-available-via-cfg.patch:
  obsolete</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1777204800">- update to 47.0.0:
  * Support for Python 3.8 is deprecated and will be removed in
    the next cryptography release.
  * BACKWARDS INCOMPATIBLE: Support for binary elliptic curves
    (SECT* classes) has been removed. These curves are rarely
    used and have additional security considerations that make
    them undesirable.
  * BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.1.x has been
    removed. OpenSSL 3.0.0 or later is now required. LibreSSL,
    BoringSSL, and AWS-LC continue to be supported.
  * BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL &lt; 4.1.
  * BACKWARDS INCOMPATIBLE: Loading keys with unsupported
    algorithms or keys with unsupported explicit curve encodings
    now raises
    :class:`~cryptography.exceptions.UnsupportedAlgorithm`
    instead of ValueError. This change affects :func:`~cryptograp
    hy.hazmat.primitives.serialization.load_pem_private_key`, :fu
    nc:`~cryptography.hazmat.primitives.serialization.load_der_pr
    ivate_key`, :func:`~cryptography.hazmat.primitives.serializat
    ion.load_pem_public_key`, :func:`~cryptography.hazmat.primiti
    ves.serialization.load_der_public_key`, and
    :meth:`~cryptography.x509.Certificate.public_key` when called
    on certificates with unsupported public key algorithms.
  * BACKWARDS INCOMPATIBLE: When parsing elliptic curve private
    keys, we now reject keys that incorrectly encode a private
    key of the wrong length because such keys are impossible to
    process in a constant-time manner. We do not believe keys
    with this problem are in wide use, however we may revert this
    change based on the feedback we receive.
  * Deprecated passing 64-bit (8-byte) and 128-bit (16-byte) keys
    to :class:`~cryptography.hazmat.decrepit.ciphers.algorithms.T
    ripleDES`. In a future release, only 192-bit (24-byte) keys
    will be accepted. Users should expand shorter keys themselves
    (e.g., for single DES: key + key + key, for two-key: key +
    key[:8]).
  * Updated the minimum supported Rust version (MSRV) to 1.83.0,
    from 1.74.0.
  * Support for x86_64 macOS (including publishing wheels) is
    deprecated and will be removed in the next release. We will
    switch to publishing an arm64 only wheel for macOS.
  * Support for 32-bit Windows (including publishing wheels) is
    deprecated and will be removed in the next release. Users
    should move to a 64-bit Python installation.
  * public_bytes and private_bytes methods on keys now raise
    TypeError (instead of ValueError) if an invalid encoding is
    provided for the given format.
  * Moved
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.CFB`,
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.OFB`, and
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.CFB8`
    into :doc:`/hazmat/decrepit/index` and deprecated them in the
    modes module. They will be removed from the modes module in
    49.0.0.
  * Moved :class:`~cryptography.hazmat.primitives.ciphers.algorit
    hms.Camellia` into  :doc:`/hazmat/decrepit/index` and
    deprecated it in the cipher module. It will be removed from
    the cipher module in 49.0.0.
  * Added
    :meth:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF.extract`
    to :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF`.
    The previous private implementation will be removed in
    49.0.0.
  * Added support for loading elliptic curve keys that contain
    explicit encodings of the curves secp256r1, secp384r1, and
    secp521r1.
  * Added support for
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2d`
    and
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2i`
    when using OpenSSL 3.2.0+.
  * Added derive_into methods to
    :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF`,
    :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDFExpand`,
    :class:`~cryptography.hazmat.primitives.kdf.concatkdf.ConcatK
    DFHash`, :class:`~cryptography.hazmat.primitives.kdf.concatkd
    f.ConcatKDFHMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2id`,
    :class:`~cryptography.hazmat.primitives.kdf.pbkdf2.PBKDF2HMAC
    `,
    :class:`~cryptography.hazmat.primitives.kdf.kbkdf.KBKDFHMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.kbkdf.KBKDFCMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.scrypt.Scrypt`,
    and
    :class:`~cryptography.hazmat.primitives.kdf.x963kdf.X963KDF`
    to allow deriving keys directly into pre-allocated buffers.
  * Added encrypt_into and decrypt_into methods to
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESCCM`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESGCM`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESGCMSI
    V`, :class:`~cryptography.hazmat.primitives.ciphers.aead.AESO
    CB3`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESSIV`,
    and :class:`~cryptography.hazmat.primitives.ciphers.aead.ChaC
    ha20Poly1305` to allow encrypting directly into a pre-
    allocated buffer.
  * Added support for PKCS1v15 signing without DigestInfo using :
    class:`~cryptography.hazmat.primitives.asymmetric.utils.NoDig
    estInfo`.
  * Added
    :meth:`~cryptography.hazmat.primitives.hashes.Hash.hash`, a
    one-shot method for computing hashes.
  * Added :doc:`/hazmat/primitives/hpke` support implementing RFC
    9180 for hybrid authenticated encryption.
  * Added new :doc:`/hazmat/primitives/asymmetric/mlkem` module
    with support for ML-KEM key encapsulation with AWS-LC and
    BoringSSL. Note: Post-quantum algorithm support requires AWS-
    LC or BoringSSL. As we ship our wheels with OpenSSL, most
    users will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Note: Post-quantum algorithm support requires AWS-LC or
    BoringSSL. As we ship our wheels with OpenSSL, most users
    will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Added new :doc:`/hazmat/primitives/asymmetric/mldsa` module
    with support for ML-DSA signing and verification with AWS-LC
    and BoringSSL. Note: Post-quantum algorithm support requires
    AWS-LC or BoringSSL. As we ship our wheels with OpenSSL, most
    users will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Note: Post-quantum algorithm support requires AWS-LC or
    BoringSSL. As we ship our wheels with OpenSSL, most users
    will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Added new :doc:`/hazmat/asn1/index` module with support for
    declaratively defining custom ASN.1 types and
    encoding/decoding them.
  * Fixed compilation when using LibreSSL 4.3.0 and OpenSSL
    4.0.0.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 4.0.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1778414400">- update to 48.0.0:
  * BACKWARDS INCOMPATIBLE: Support for Python 3.8 has been
    removed. cryptography now requires Python 3.9 or later.
  * BACKWARDS INCOMPATIBLE: Loading an X.509 CRL whose inner
    TBSCertList.signature algorithm does not match the outer
    signatureAlgorithm now raises ValueError. Previously, such
    CRLs were parsed successfully and only rejected during
    signature validation.
  * Added support for :doc:`/hazmat/primitives/asymmetric/mlkem`
    and :doc:`/hazmat/primitives/asymmetric/mldsa` when using
    OpenSSL 3.5.0 or later, in addition to the existing AWS-LC
    and BoringSSL support. This means post-quantum algorithms are
    now available to users of our wheels. Note: Going forward, we
    do not guarantee that all functionality in cryptography will
    be available when building against OpenSSL. See
    :doc:`/statements/state-of-openssl` for more information.
  * Note: Going forward, we do not guarantee that all
    functionality in cryptography will be available when building
    against OpenSSL. See :doc:`/statements/state-of-openssl` for
    more information.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1781438400">- update to 49.0.0:
  * BACKWARDS INCOMPATIBLE: Removed the deprecated
    PUBLIC_KEY_TYPES, PRIVATE_KEY_TYPES,
    CERTIFICATE_PRIVATE_KEY_TYPES,
    CERTIFICATE_ISSUER_PUBLIC_KEY_TYPES, and
    CERTIFICATE_PUBLIC_KEY_TYPES type aliases. Use
    PublicKeyTypes, PrivateKeyTypes,
    CertificateIssuerPrivateKeyTypes,
    CertificateIssuerPublicKeyTypes, and
    CertificatePublicKeyTypes instead. These were deprecated in
    version 40.0.
  * BACKWARDS INCOMPATIBLE: :class:`~cryptography.hazmat.primitiv
    es.ciphers.algorithms.ChaCha20` now treats the first 4 bytes
    of the nonce as a 32-bit little-endian block counter (as
    defined in RFC 7539) and tracks the number of bytes
    processed. Attempting to encrypt or decrypt more data than
    the counter allows before it would overflow now raises a
    :class:`ValueError` rather than silently diverging from RFC
    7539. Setting the counter portion of the nonce to zero allows
    encrypting up to 256 GiB with a given nonce.
  * BACKWARDS INCOMPATIBLE: Loading an X.509 certificate whose
    ECDSA or DSA signature AlgorithmIdentifier contains encoded
    NULL parameters now raises a :class:`ValueError`. Such
    certificates are invalid, but older versions of Java emitted
    them; previously they loaded with a deprecation warning.
  * Fixed cross-compilation of the CFFI bindings when
    PYO3_CROSS_LIB_DIR is set. The build now derives the Python
    include directory from PYO3_CROSS_LIB_DIR instead of querying
    the host interpreter, which previously caused the build to
    fail during cross-compilations for embedded systems, on hosts
    which have same-version Python development headers installed
    as the target Python.
  * Added support for signing and verifying X.509 certificates,
    certificate signing requests, and certificate revocation
    lists with :doc:`/hazmat/primitives/asymmetric/mldsa` keys,
    as well as loading certificates that contain ML-DSA public
    keys.
  * Added
    :meth:`~cryptography.hazmat.primitives.hpke.KEM.enc_length`
    to :class:`~cryptography.hazmat.primitives.hpke.KEM` so
    callers can split the encapsulated key from the ciphertext
    returned by
    :meth:`~cryptography.hazmat.primitives.hpke.Suite.encrypt`.
  * :meth:`~cryptography.x509.verification.ExtensionPolicy.requir
    e_present`, :meth:`~cryptography.x509.verification.ExtensionP
    olicy.may_be_present`, and :meth:`~cryptography.x509.verifica
    tion.ExtensionPolicy.require_not_present` now accept any
    extension type. Previously only a fixed set of extension
    types was supported, which made it impossible to account for
    otherwise unrecognized critical extensions during path
    validation.
  * Added support for using
    :class:`~cryptography.x509.Certificate`,
    :class:`~cryptography.x509.CertificateSigningRequest`, and
    :class:`~cryptography.x509.CertificateRevocationList` as
    field types in :doc:`/hazmat/asn1/index` structures.
  * Added :func:`~cryptography.hazmat.asn1.value_set`, a class
    decorator that registers an :class:`enum.Enum` subclass as an
    ASN.1 value set: members are encoded as their underlying
    value, and decoding fails if the decoded value does not match
    one of the declared members.
  * Added :meth:`~cryptography.x509.Name.from_bytes` for parsing
    a :class:`~cryptography.x509.Name` from DER bytes, the
    inverse of :meth:`~cryptography.x509.Name.public_bytes`.
  * Added the rsa_padding keyword-only parameter to
    :meth:`~cryptography.x509.CertificateBuilder.public_key`.
    Passing the :class:`~cryptography.hazmat.primitives.asymmetri
    c.padding.PSS` class (not an instance) encodes an RSA subject
    public key in the certificate's subjectPublicKeyInfo with the
    id-RSASSA-PSS OID and no parameters.
  * Added external mu (message representative) support to
    :doc:`/hazmat/primitives/asymmetric/mldsa` via the sign_mu
    and verify_mu methods, which sign and verify a precomputed
    64-byte mu as defined in FIPS 204.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 4.0.1.</changelog>
</package>
<package pkgid="9c248a42992581262bd707a033b32eaeec41d65f77a8f6a1949187fe1084cec7b397286bd656e7309c0ebead92626a1bf308eb4c119d191ee07072d54bd2dcc8" name="python311-cryptography" arch="x86_64">
  <version epoch="0" ver="49.0.0" rel="289.3"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1727524800">- update to 43.0.1:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.3.2.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1729598400">- update to 43.0.3:
  * Fixed release metadata for cryptography-vectors
  * Fixed compilation when using LibreSSL 4.0.0.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1730808000">- Avoid using requires_eq, which after the last modifications
  conflicts with python singlespec (order of expansion).</changelog>
  <changelog author="Ben Greiner &lt;code@bnavigator.de&gt;" date="1731067200">- Fix requires_eq replacement for distributions which do not have
  python3-cffi installed (such as SLE15 python module pythons)
  * gh#openSUSE/python-rpm-macros#185
- Remove outdated section in description</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfyhalomacro@opensuse.org&gt;" date="1737892800">- Update to version 44.0.0:
  * BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL &lt; 3.9.
  * Deprecated Python 3.7 support. Python 3.7 is no longer supported by
    the Python core team. Support for Python 3.7 will be removed in a future
    cryptography release.
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.4.0.
  * macOS wheels are now built against the macOS 10.13 SDK. Users on older
    versions of macOS should upgrade, or they will need to build cryptography
    themselves.
  * Enforce the RFC 5280 requirement that extended key usage extensions must not be empty.
  * Added support for timestamp extraction to the :class:`~cryptography.fernet.MultiFernet` class.
  * Relax the Authority Key Identifier requirements on root CA certificates
    during X.509 verification to allow fields permitted by RFC 5280 but
    forbidden by the CA/Browser BRs.
  * Added support for
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2id` when using
    OpenSSL 3.2.0+.
  * Added support for the :class:`~cryptography.x509.Admissions` certificate extension.
  * Added basic support for PKCS7 decryption (including S/MIME 3.2) via
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der`,
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_pem`,
    and :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_smime`.
- Update specfile to accommodate new project structure at version 44.0.0
- Update no-pytest_benchmark.patch</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1740571200">- update to 44.0.1:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.4.1.
  * We now build armv7l manylinux wheels and publish them to
    PyPI.
  * We now build manylinux_2_34 wheels and publish them to PyPI.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1742731200">- update to 44.0.2:
  * We now build wheels for PyPy 3.11.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1746619200">- Update to 44.0.3
  * Fixed compilation when using LibreSSL 4.1.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1752321600">- update to 45.0.5:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.1.
  * Fixed decrypting PKCS#8 files encrypted with SHA1-RC4. (This
    is not considered secure, and is supported only for backwards
    compatibility.)
  * Fixed decrypting PKCS#8 files encrypted with long salts (this
    impacts keys encrypted by Bouncy Castle).
  * Fixed decrypting PKCS#8 files encrypted with DES-CBC-MD5.
    While wildly insecure, this remains prevalent.
  * Fixed using mypy with cryptography on older versions of
    Python.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.0.
  * Support for Python 3.7 is deprecated and will be removed in
    the next cryptography release.
  * Updated the minimum supported Rust version (MSRV) to 1.74.0,
    from 1.65.0.
  * Added support for serialization of PKCS#12 Java truststores
    in :func:`~cryptography.hazmat.primitives.serialization.pkcs1
    2.serialize_java_truststore`
  * Added :meth:`~cryptography.hazmat.primitives.kdf.argon2.Argon
    2id.derive_phc_encoded` and :meth:`~cryptography.hazmat.primi
    tives.kdf.argon2.Argon2id.verify_phc_encoded` methods to
    support password hashing in the PHC string format
  * Added support for PKCS7 decryption and encryption using
    AES-256 as the content algorithm, in addition to AES-128.
  * BACKWARDS INCOMPATIBLE: Made SSH private key loading more
    consistent with other private key loading: :func:`~cryptograp
    hy.hazmat.primitives.serialization.load_ssh_private_key` now
    raises a TypeError if the key is unencrypted but a password
    is provided (previously no exception was raised), and raises
    a TypeError if the key is encrypted but no password is
    provided (previously a ValueError was raised).
  * Added __copy__ to the :class:`~cryptography.hazmat.primitives
    .asymmetric.ec.EllipticCurvePrivateKey`, :class:`~cryptograph
    y.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey`, :c
    lass:`~cryptography.hazmat.primitives.asymmetric.ed25519.Ed25
    519PublicKey`, :class:`~cryptography.hazmat.primitives.asymme
    tric.ed25519.Ed25519PrivateKey`, :class:`~cryptography.hazmat
    .primitives.asymmetric.ed448.Ed448PublicKey`, :class:`~crypto
    graphy.hazmat.primitives.asymmetric.ed448.Ed448PrivateKey`, :
    class:`~cryptography.hazmat.primitives.asymmetric.x25519.X255
    19PublicKey`, :class:`~cryptography.hazmat.primitives.asymmet
    ric.x25519.X25519PrivateKey`, :class:`~cryptography.hazmat.pr
    imitives.asymmetric.x448.X448PublicKey`, :class:`~cryptograph
    y.hazmat.primitives.asymmetric.x448.X448PrivateKey`, :class:`
    ~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey`
    , :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAP
    ublicKey`, :class:`~cryptography.hazmat.primitives.asymmetric
    .dsa.DSAPrivateKey`, :class:`~cryptography.hazmat.primitives.
    asymmetric.dsa.DSAPublicKey`, :class:`~cryptography.hazmat.pr
    imitives.asymmetric.dh.DHPrivateKey`, and :class:`~cryptograp
    hy.hazmat.primitives.asymmetric.dh.DHPublicKey` abstract base
    classes.
  * We significantly refactored how private key loading ( :func:`
    ~cryptography.hazmat.primitives.serialization.load_pem_privat
    e_key` and :func:`~cryptography.hazmat.primitives.serializati
    on.load_der_private_key`) works. This is intended to be
    backwards compatible for all well-formed keys, therefore if
    you discover a key that now raises an exception, please file
    a bug with instructions for reproducing.
  * Added unsafe_skip_rsa_key_validation keyword-argument to :fun
    c:`~cryptography.hazmat.primitives.serialization.load_ssh_pri
    vate_key`.
  * Added :class:`~cryptography.hazmat.primitives.hashes.XOFHash`
    to support repeated :meth:`~cryptography.hazmat.primitives.ha
    shes.XOFHash.squeeze` operations on extendable output
    functions.
  * Added :meth:`~cryptography.x509.ocsp.OCSPResponseBuilder.add_
    response_by_hash` method to allow creating OCSP responses
    using certificate hash values rather than full certificates.
  * Extended the :mod:`X.509 path validation
    &lt;cryptography.x509.verification&gt;` API to support user-
    configured extension policies via the
    :meth:`PolicyBuilder.extension_policies &lt;cryptography.x509.ve
    rification.PolicyBuilder.extension_policies&gt;` method.
  * Deprecated the subject, verification_time and max_chain_depth
    properties on
    :class:`~cryptography.x509.verification.ClientVerifier` and
    :class:`~cryptography.x509.verification.ServerVerifier` in
    favor of a new policy property. These properties will be
    removed in the next release of cryptography.
  * BACKWARDS INCOMPATIBLE: The :meth:`VerifiedClient.subject
    &lt;cryptography.x509.verification.VerifiedClient.subjects&gt;`
    property can now be None since a custom extension policy may
    allow certificates without a Subject Alternative Name
    extension.
  * Changed the behavior when the OpenSSL 3 legacy provider fails
    to load. Instead of raising an exception, a warning is now
    emitted. The CRYPTOGRAPHY_OPENSSL_NO_LEGACY environment
    variable can still be used to disable the legacy provider at
    runtime.
  * Added support for the CRYPTOGRAPHY_BUILD_OPENSSL_NO_LEGACY
    environment variable during build time, which prevents the
    library from ever attempting to load the legacy provider.
  * Added support for the
    :class:`~cryptography.x509.PrivateKeyUsagePeriod` X.509
    extension. This extension defines the period during which the
    private key corresponding to the certificate's public key may
    be used.
  * Added support for compiling against `aws-lc`_.
  * Parsing X.509 structures now more strictly enforces that Name
    structures do not have malformed ASN.1.
  * We now publish py311 wheels that utilize the faster
    pyo3::buffer::PyBuffer interface, resulting in significantly
    improved performance for operations involving small buffers.
  * Added :func:`~cryptography.hazmat.primitives.serialization.ss
    h_key_fingerprint` for computing fingerprints of SSH public
    keys.
  * Added support for deterministic ECDSA signing via the new
    keyword-only argument ecdsa_deterministic in
    :meth:`~cryptography.x509.CertificateBuilder.sign`, :meth:`~c
    ryptography.x509.CertificateRevocationListBuilder.sign` and :
    meth:`~cryptography.x509.CertificateSigningRequestBuilder.sig
    n`.</changelog>
  <changelog author="James Oakley &lt;jfunk@opensuse.org&gt;" date="1756728000">- Add Make-unsafe-subinterpreter-support-available-via-cfg.patch
  to allow ceph-mgr to load modules (boo#1248987)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1757851200">- update to 45.0.7:
  * Added a function to support an upcoming pyOpenSSL release.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1760356800">- update to 46.0.2:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.4.
  * Fixed an issue where users installing via pip on Python 3.14
    development versions would not properly install a dependency.
  * Fixed an issue building the free-threaded macOS 3.14 wheels.
  * BACKWARDS INCOMPATIBLE: Support for Python 3.7 has been
    removed.
  * Support for OpenSSL &lt; 3.0 is deprecated and will be removed
    in the next release.
  * Support for x86_64 macOS (including publishing wheels) is
    deprecated and will be removed in two releases. We will
    switch to publishing an arm64 only wheel for macOS.
  * Support for 32-bit Windows (including publishing wheels) is
    deprecated and will be removed in two releases. Users should
    move to a 64-bit Python installation.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.3.
  * We now build ppc64le manylinux wheels and publish them to
    PyPI.
  * We now build win_arm64 (Windows on Arm) wheels and publish
    them to PyPI.
  * Added support for free-threaded Python 3.14.
  * Removed the deprecated get_attribute_for_oid method on
    :class:`~cryptography.x509.CertificateSigningRequest`. Users
    should use
    :meth:`~cryptography.x509.Attributes.get_attribute_for_oid`
    instead.
  * Removed the deprecated CAST5, SEED, IDEA, and Blowfish
    classes from the cipher module. These are still available in
    :doc:`/hazmat/decrepit/index`.
  * In X.509, when performing a PSS signature with a SHA-3 hash,
    it is now encoded with the official NIST SHA3 OID.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1765195200">- Only require pytest-subtests with pytest &lt; 9.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1770897600">- Update to 46.0.5 (fixes CVE-2026-26007, bsc#1258074)
  * An attacker could create a malicious public key that reveals portions of
    your private key when using certain uncommon elliptic curves (binary
    curves). This version now includes additional security checks to prevent
    this attack. This issue only affects binary elliptic curves, which are
    rarely used in real-world applications. Credit to XlabAI Team of Tencent
    Xuanwu Lab and Atuin Automated Vulnerability Discovery Engine for reporting
    the issue. CVE-2026-26007
  * Support for SECT* binary elliptic curves is deprecated and will be removed
    in the next release.
- Update to 46.0.4
  * Dropped support for win_arm64 wheels.
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.5.
- Update to 46.0.3
  * Fixed compilation when using LibreSSL 4.2.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1774612800">- update to 46.0.6 (CVE-2026-34073, bsc#1260876):
  * SECURITY ISSUE: Fixed a bug where name constraints were not
    applied to peer names during verification when the leaf
    certificate contains a wildcard DNS SAN. Ordinary X.509
    topologies are not affected by this bug, including those used
    by the Web PKI. Credit to Oleh Konko (1seal) for reporting
    the issue. CVE-2026-34073</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1774958400">- Add patch support-maturin-1.12.patch:
  * Correctly deal with maturin bugfix that installs tests and
    docs under sitearch.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1775822400">- Update to 46.0.7 (fixes CVE-2026-39892, bsc#1261863)
  * **SECURITY ISSUE**: Fixed an issue where non-contiguous buffers could be
    passed to APIs that accept Python buffers, which could lead to buffer
    overflow. **CVE-2026-39892**
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.6.
- drop support-maturin-1.12.patch (upstream)
- drop no-pytest_benchmark.patch,
  Make-unsafe-subinterpreter-support-available-via-cfg.patch:
  obsolete</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1777204800">- update to 47.0.0:
  * Support for Python 3.8 is deprecated and will be removed in
    the next cryptography release.
  * BACKWARDS INCOMPATIBLE: Support for binary elliptic curves
    (SECT* classes) has been removed. These curves are rarely
    used and have additional security considerations that make
    them undesirable.
  * BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.1.x has been
    removed. OpenSSL 3.0.0 or later is now required. LibreSSL,
    BoringSSL, and AWS-LC continue to be supported.
  * BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL &lt; 4.1.
  * BACKWARDS INCOMPATIBLE: Loading keys with unsupported
    algorithms or keys with unsupported explicit curve encodings
    now raises
    :class:`~cryptography.exceptions.UnsupportedAlgorithm`
    instead of ValueError. This change affects :func:`~cryptograp
    hy.hazmat.primitives.serialization.load_pem_private_key`, :fu
    nc:`~cryptography.hazmat.primitives.serialization.load_der_pr
    ivate_key`, :func:`~cryptography.hazmat.primitives.serializat
    ion.load_pem_public_key`, :func:`~cryptography.hazmat.primiti
    ves.serialization.load_der_public_key`, and
    :meth:`~cryptography.x509.Certificate.public_key` when called
    on certificates with unsupported public key algorithms.
  * BACKWARDS INCOMPATIBLE: When parsing elliptic curve private
    keys, we now reject keys that incorrectly encode a private
    key of the wrong length because such keys are impossible to
    process in a constant-time manner. We do not believe keys
    with this problem are in wide use, however we may revert this
    change based on the feedback we receive.
  * Deprecated passing 64-bit (8-byte) and 128-bit (16-byte) keys
    to :class:`~cryptography.hazmat.decrepit.ciphers.algorithms.T
    ripleDES`. In a future release, only 192-bit (24-byte) keys
    will be accepted. Users should expand shorter keys themselves
    (e.g., for single DES: key + key + key, for two-key: key +
    key[:8]).
  * Updated the minimum supported Rust version (MSRV) to 1.83.0,
    from 1.74.0.
  * Support for x86_64 macOS (including publishing wheels) is
    deprecated and will be removed in the next release. We will
    switch to publishing an arm64 only wheel for macOS.
  * Support for 32-bit Windows (including publishing wheels) is
    deprecated and will be removed in the next release. Users
    should move to a 64-bit Python installation.
  * public_bytes and private_bytes methods on keys now raise
    TypeError (instead of ValueError) if an invalid encoding is
    provided for the given format.
  * Moved
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.CFB`,
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.OFB`, and
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.CFB8`
    into :doc:`/hazmat/decrepit/index` and deprecated them in the
    modes module. They will be removed from the modes module in
    49.0.0.
  * Moved :class:`~cryptography.hazmat.primitives.ciphers.algorit
    hms.Camellia` into  :doc:`/hazmat/decrepit/index` and
    deprecated it in the cipher module. It will be removed from
    the cipher module in 49.0.0.
  * Added
    :meth:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF.extract`
    to :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF`.
    The previous private implementation will be removed in
    49.0.0.
  * Added support for loading elliptic curve keys that contain
    explicit encodings of the curves secp256r1, secp384r1, and
    secp521r1.
  * Added support for
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2d`
    and
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2i`
    when using OpenSSL 3.2.0+.
  * Added derive_into methods to
    :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF`,
    :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDFExpand`,
    :class:`~cryptography.hazmat.primitives.kdf.concatkdf.ConcatK
    DFHash`, :class:`~cryptography.hazmat.primitives.kdf.concatkd
    f.ConcatKDFHMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2id`,
    :class:`~cryptography.hazmat.primitives.kdf.pbkdf2.PBKDF2HMAC
    `,
    :class:`~cryptography.hazmat.primitives.kdf.kbkdf.KBKDFHMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.kbkdf.KBKDFCMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.scrypt.Scrypt`,
    and
    :class:`~cryptography.hazmat.primitives.kdf.x963kdf.X963KDF`
    to allow deriving keys directly into pre-allocated buffers.
  * Added encrypt_into and decrypt_into methods to
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESCCM`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESGCM`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESGCMSI
    V`, :class:`~cryptography.hazmat.primitives.ciphers.aead.AESO
    CB3`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESSIV`,
    and :class:`~cryptography.hazmat.primitives.ciphers.aead.ChaC
    ha20Poly1305` to allow encrypting directly into a pre-
    allocated buffer.
  * Added support for PKCS1v15 signing without DigestInfo using :
    class:`~cryptography.hazmat.primitives.asymmetric.utils.NoDig
    estInfo`.
  * Added
    :meth:`~cryptography.hazmat.primitives.hashes.Hash.hash`, a
    one-shot method for computing hashes.
  * Added :doc:`/hazmat/primitives/hpke` support implementing RFC
    9180 for hybrid authenticated encryption.
  * Added new :doc:`/hazmat/primitives/asymmetric/mlkem` module
    with support for ML-KEM key encapsulation with AWS-LC and
    BoringSSL. Note: Post-quantum algorithm support requires AWS-
    LC or BoringSSL. As we ship our wheels with OpenSSL, most
    users will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Note: Post-quantum algorithm support requires AWS-LC or
    BoringSSL. As we ship our wheels with OpenSSL, most users
    will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Added new :doc:`/hazmat/primitives/asymmetric/mldsa` module
    with support for ML-DSA signing and verification with AWS-LC
    and BoringSSL. Note: Post-quantum algorithm support requires
    AWS-LC or BoringSSL. As we ship our wheels with OpenSSL, most
    users will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Note: Post-quantum algorithm support requires AWS-LC or
    BoringSSL. As we ship our wheels with OpenSSL, most users
    will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Added new :doc:`/hazmat/asn1/index` module with support for
    declaratively defining custom ASN.1 types and
    encoding/decoding them.
  * Fixed compilation when using LibreSSL 4.3.0 and OpenSSL
    4.0.0.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 4.0.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1778414400">- update to 48.0.0:
  * BACKWARDS INCOMPATIBLE: Support for Python 3.8 has been
    removed. cryptography now requires Python 3.9 or later.
  * BACKWARDS INCOMPATIBLE: Loading an X.509 CRL whose inner
    TBSCertList.signature algorithm does not match the outer
    signatureAlgorithm now raises ValueError. Previously, such
    CRLs were parsed successfully and only rejected during
    signature validation.
  * Added support for :doc:`/hazmat/primitives/asymmetric/mlkem`
    and :doc:`/hazmat/primitives/asymmetric/mldsa` when using
    OpenSSL 3.5.0 or later, in addition to the existing AWS-LC
    and BoringSSL support. This means post-quantum algorithms are
    now available to users of our wheels. Note: Going forward, we
    do not guarantee that all functionality in cryptography will
    be available when building against OpenSSL. See
    :doc:`/statements/state-of-openssl` for more information.
  * Note: Going forward, we do not guarantee that all
    functionality in cryptography will be available when building
    against OpenSSL. See :doc:`/statements/state-of-openssl` for
    more information.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1781438400">- update to 49.0.0:
  * BACKWARDS INCOMPATIBLE: Removed the deprecated
    PUBLIC_KEY_TYPES, PRIVATE_KEY_TYPES,
    CERTIFICATE_PRIVATE_KEY_TYPES,
    CERTIFICATE_ISSUER_PUBLIC_KEY_TYPES, and
    CERTIFICATE_PUBLIC_KEY_TYPES type aliases. Use
    PublicKeyTypes, PrivateKeyTypes,
    CertificateIssuerPrivateKeyTypes,
    CertificateIssuerPublicKeyTypes, and
    CertificatePublicKeyTypes instead. These were deprecated in
    version 40.0.
  * BACKWARDS INCOMPATIBLE: :class:`~cryptography.hazmat.primitiv
    es.ciphers.algorithms.ChaCha20` now treats the first 4 bytes
    of the nonce as a 32-bit little-endian block counter (as
    defined in RFC 7539) and tracks the number of bytes
    processed. Attempting to encrypt or decrypt more data than
    the counter allows before it would overflow now raises a
    :class:`ValueError` rather than silently diverging from RFC
    7539. Setting the counter portion of the nonce to zero allows
    encrypting up to 256 GiB with a given nonce.
  * BACKWARDS INCOMPATIBLE: Loading an X.509 certificate whose
    ECDSA or DSA signature AlgorithmIdentifier contains encoded
    NULL parameters now raises a :class:`ValueError`. Such
    certificates are invalid, but older versions of Java emitted
    them; previously they loaded with a deprecation warning.
  * Fixed cross-compilation of the CFFI bindings when
    PYO3_CROSS_LIB_DIR is set. The build now derives the Python
    include directory from PYO3_CROSS_LIB_DIR instead of querying
    the host interpreter, which previously caused the build to
    fail during cross-compilations for embedded systems, on hosts
    which have same-version Python development headers installed
    as the target Python.
  * Added support for signing and verifying X.509 certificates,
    certificate signing requests, and certificate revocation
    lists with :doc:`/hazmat/primitives/asymmetric/mldsa` keys,
    as well as loading certificates that contain ML-DSA public
    keys.
  * Added
    :meth:`~cryptography.hazmat.primitives.hpke.KEM.enc_length`
    to :class:`~cryptography.hazmat.primitives.hpke.KEM` so
    callers can split the encapsulated key from the ciphertext
    returned by
    :meth:`~cryptography.hazmat.primitives.hpke.Suite.encrypt`.
  * :meth:`~cryptography.x509.verification.ExtensionPolicy.requir
    e_present`, :meth:`~cryptography.x509.verification.ExtensionP
    olicy.may_be_present`, and :meth:`~cryptography.x509.verifica
    tion.ExtensionPolicy.require_not_present` now accept any
    extension type. Previously only a fixed set of extension
    types was supported, which made it impossible to account for
    otherwise unrecognized critical extensions during path
    validation.
  * Added support for using
    :class:`~cryptography.x509.Certificate`,
    :class:`~cryptography.x509.CertificateSigningRequest`, and
    :class:`~cryptography.x509.CertificateRevocationList` as
    field types in :doc:`/hazmat/asn1/index` structures.
  * Added :func:`~cryptography.hazmat.asn1.value_set`, a class
    decorator that registers an :class:`enum.Enum` subclass as an
    ASN.1 value set: members are encoded as their underlying
    value, and decoding fails if the decoded value does not match
    one of the declared members.
  * Added :meth:`~cryptography.x509.Name.from_bytes` for parsing
    a :class:`~cryptography.x509.Name` from DER bytes, the
    inverse of :meth:`~cryptography.x509.Name.public_bytes`.
  * Added the rsa_padding keyword-only parameter to
    :meth:`~cryptography.x509.CertificateBuilder.public_key`.
    Passing the :class:`~cryptography.hazmat.primitives.asymmetri
    c.padding.PSS` class (not an instance) encodes an RSA subject
    public key in the certificate's subjectPublicKeyInfo with the
    id-RSASSA-PSS OID and no parameters.
  * Added external mu (message representative) support to
    :doc:`/hazmat/primitives/asymmetric/mldsa` via the sign_mu
    and verify_mu methods, which sign and verify a precomputed
    64-byte mu as defined in FIPS 204.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 4.0.1.</changelog>
</package>
<package pkgid="585b3601d65ffc4b2ff6e471366c1b1a48b638c40ce2a67635edb9d867a6aadfd8cb0763e9cc4e9e469f3bad6405f3a338428112857e83648f1feeba5335c26f" name="python311-cryptography-debuginfo" arch="aarch64">
  <version epoch="0" ver="49.0.0" rel="289.3"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1727524800">- update to 43.0.1:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.3.2.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1729598400">- update to 43.0.3:
  * Fixed release metadata for cryptography-vectors
  * Fixed compilation when using LibreSSL 4.0.0.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1730808000">- Avoid using requires_eq, which after the last modifications
  conflicts with python singlespec (order of expansion).</changelog>
  <changelog author="Ben Greiner &lt;code@bnavigator.de&gt;" date="1731067200">- Fix requires_eq replacement for distributions which do not have
  python3-cffi installed (such as SLE15 python module pythons)
  * gh#openSUSE/python-rpm-macros#185
- Remove outdated section in description</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfyhalomacro@opensuse.org&gt;" date="1737892800">- Update to version 44.0.0:
  * BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL &lt; 3.9.
  * Deprecated Python 3.7 support. Python 3.7 is no longer supported by
    the Python core team. Support for Python 3.7 will be removed in a future
    cryptography release.
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.4.0.
  * macOS wheels are now built against the macOS 10.13 SDK. Users on older
    versions of macOS should upgrade, or they will need to build cryptography
    themselves.
  * Enforce the RFC 5280 requirement that extended key usage extensions must not be empty.
  * Added support for timestamp extraction to the :class:`~cryptography.fernet.MultiFernet` class.
  * Relax the Authority Key Identifier requirements on root CA certificates
    during X.509 verification to allow fields permitted by RFC 5280 but
    forbidden by the CA/Browser BRs.
  * Added support for
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2id` when using
    OpenSSL 3.2.0+.
  * Added support for the :class:`~cryptography.x509.Admissions` certificate extension.
  * Added basic support for PKCS7 decryption (including S/MIME 3.2) via
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der`,
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_pem`,
    and :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_smime`.
- Update specfile to accommodate new project structure at version 44.0.0
- Update no-pytest_benchmark.patch</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1740571200">- update to 44.0.1:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.4.1.
  * We now build armv7l manylinux wheels and publish them to
    PyPI.
  * We now build manylinux_2_34 wheels and publish them to PyPI.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1742731200">- update to 44.0.2:
  * We now build wheels for PyPy 3.11.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1746619200">- Update to 44.0.3
  * Fixed compilation when using LibreSSL 4.1.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1752321600">- update to 45.0.5:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.1.
  * Fixed decrypting PKCS#8 files encrypted with SHA1-RC4. (This
    is not considered secure, and is supported only for backwards
    compatibility.)
  * Fixed decrypting PKCS#8 files encrypted with long salts (this
    impacts keys encrypted by Bouncy Castle).
  * Fixed decrypting PKCS#8 files encrypted with DES-CBC-MD5.
    While wildly insecure, this remains prevalent.
  * Fixed using mypy with cryptography on older versions of
    Python.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.0.
  * Support for Python 3.7 is deprecated and will be removed in
    the next cryptography release.
  * Updated the minimum supported Rust version (MSRV) to 1.74.0,
    from 1.65.0.
  * Added support for serialization of PKCS#12 Java truststores
    in :func:`~cryptography.hazmat.primitives.serialization.pkcs1
    2.serialize_java_truststore`
  * Added :meth:`~cryptography.hazmat.primitives.kdf.argon2.Argon
    2id.derive_phc_encoded` and :meth:`~cryptography.hazmat.primi
    tives.kdf.argon2.Argon2id.verify_phc_encoded` methods to
    support password hashing in the PHC string format
  * Added support for PKCS7 decryption and encryption using
    AES-256 as the content algorithm, in addition to AES-128.
  * BACKWARDS INCOMPATIBLE: Made SSH private key loading more
    consistent with other private key loading: :func:`~cryptograp
    hy.hazmat.primitives.serialization.load_ssh_private_key` now
    raises a TypeError if the key is unencrypted but a password
    is provided (previously no exception was raised), and raises
    a TypeError if the key is encrypted but no password is
    provided (previously a ValueError was raised).
  * Added __copy__ to the :class:`~cryptography.hazmat.primitives
    .asymmetric.ec.EllipticCurvePrivateKey`, :class:`~cryptograph
    y.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey`, :c
    lass:`~cryptography.hazmat.primitives.asymmetric.ed25519.Ed25
    519PublicKey`, :class:`~cryptography.hazmat.primitives.asymme
    tric.ed25519.Ed25519PrivateKey`, :class:`~cryptography.hazmat
    .primitives.asymmetric.ed448.Ed448PublicKey`, :class:`~crypto
    graphy.hazmat.primitives.asymmetric.ed448.Ed448PrivateKey`, :
    class:`~cryptography.hazmat.primitives.asymmetric.x25519.X255
    19PublicKey`, :class:`~cryptography.hazmat.primitives.asymmet
    ric.x25519.X25519PrivateKey`, :class:`~cryptography.hazmat.pr
    imitives.asymmetric.x448.X448PublicKey`, :class:`~cryptograph
    y.hazmat.primitives.asymmetric.x448.X448PrivateKey`, :class:`
    ~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey`
    , :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAP
    ublicKey`, :class:`~cryptography.hazmat.primitives.asymmetric
    .dsa.DSAPrivateKey`, :class:`~cryptography.hazmat.primitives.
    asymmetric.dsa.DSAPublicKey`, :class:`~cryptography.hazmat.pr
    imitives.asymmetric.dh.DHPrivateKey`, and :class:`~cryptograp
    hy.hazmat.primitives.asymmetric.dh.DHPublicKey` abstract base
    classes.
  * We significantly refactored how private key loading ( :func:`
    ~cryptography.hazmat.primitives.serialization.load_pem_privat
    e_key` and :func:`~cryptography.hazmat.primitives.serializati
    on.load_der_private_key`) works. This is intended to be
    backwards compatible for all well-formed keys, therefore if
    you discover a key that now raises an exception, please file
    a bug with instructions for reproducing.
  * Added unsafe_skip_rsa_key_validation keyword-argument to :fun
    c:`~cryptography.hazmat.primitives.serialization.load_ssh_pri
    vate_key`.
  * Added :class:`~cryptography.hazmat.primitives.hashes.XOFHash`
    to support repeated :meth:`~cryptography.hazmat.primitives.ha
    shes.XOFHash.squeeze` operations on extendable output
    functions.
  * Added :meth:`~cryptography.x509.ocsp.OCSPResponseBuilder.add_
    response_by_hash` method to allow creating OCSP responses
    using certificate hash values rather than full certificates.
  * Extended the :mod:`X.509 path validation
    &lt;cryptography.x509.verification&gt;` API to support user-
    configured extension policies via the
    :meth:`PolicyBuilder.extension_policies &lt;cryptography.x509.ve
    rification.PolicyBuilder.extension_policies&gt;` method.
  * Deprecated the subject, verification_time and max_chain_depth
    properties on
    :class:`~cryptography.x509.verification.ClientVerifier` and
    :class:`~cryptography.x509.verification.ServerVerifier` in
    favor of a new policy property. These properties will be
    removed in the next release of cryptography.
  * BACKWARDS INCOMPATIBLE: The :meth:`VerifiedClient.subject
    &lt;cryptography.x509.verification.VerifiedClient.subjects&gt;`
    property can now be None since a custom extension policy may
    allow certificates without a Subject Alternative Name
    extension.
  * Changed the behavior when the OpenSSL 3 legacy provider fails
    to load. Instead of raising an exception, a warning is now
    emitted. The CRYPTOGRAPHY_OPENSSL_NO_LEGACY environment
    variable can still be used to disable the legacy provider at
    runtime.
  * Added support for the CRYPTOGRAPHY_BUILD_OPENSSL_NO_LEGACY
    environment variable during build time, which prevents the
    library from ever attempting to load the legacy provider.
  * Added support for the
    :class:`~cryptography.x509.PrivateKeyUsagePeriod` X.509
    extension. This extension defines the period during which the
    private key corresponding to the certificate's public key may
    be used.
  * Added support for compiling against `aws-lc`_.
  * Parsing X.509 structures now more strictly enforces that Name
    structures do not have malformed ASN.1.
  * We now publish py311 wheels that utilize the faster
    pyo3::buffer::PyBuffer interface, resulting in significantly
    improved performance for operations involving small buffers.
  * Added :func:`~cryptography.hazmat.primitives.serialization.ss
    h_key_fingerprint` for computing fingerprints of SSH public
    keys.
  * Added support for deterministic ECDSA signing via the new
    keyword-only argument ecdsa_deterministic in
    :meth:`~cryptography.x509.CertificateBuilder.sign`, :meth:`~c
    ryptography.x509.CertificateRevocationListBuilder.sign` and :
    meth:`~cryptography.x509.CertificateSigningRequestBuilder.sig
    n`.</changelog>
  <changelog author="James Oakley &lt;jfunk@opensuse.org&gt;" date="1756728000">- Add Make-unsafe-subinterpreter-support-available-via-cfg.patch
  to allow ceph-mgr to load modules (boo#1248987)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1757851200">- update to 45.0.7:
  * Added a function to support an upcoming pyOpenSSL release.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1760356800">- update to 46.0.2:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.4.
  * Fixed an issue where users installing via pip on Python 3.14
    development versions would not properly install a dependency.
  * Fixed an issue building the free-threaded macOS 3.14 wheels.
  * BACKWARDS INCOMPATIBLE: Support for Python 3.7 has been
    removed.
  * Support for OpenSSL &lt; 3.0 is deprecated and will be removed
    in the next release.
  * Support for x86_64 macOS (including publishing wheels) is
    deprecated and will be removed in two releases. We will
    switch to publishing an arm64 only wheel for macOS.
  * Support for 32-bit Windows (including publishing wheels) is
    deprecated and will be removed in two releases. Users should
    move to a 64-bit Python installation.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.3.
  * We now build ppc64le manylinux wheels and publish them to
    PyPI.
  * We now build win_arm64 (Windows on Arm) wheels and publish
    them to PyPI.
  * Added support for free-threaded Python 3.14.
  * Removed the deprecated get_attribute_for_oid method on
    :class:`~cryptography.x509.CertificateSigningRequest`. Users
    should use
    :meth:`~cryptography.x509.Attributes.get_attribute_for_oid`
    instead.
  * Removed the deprecated CAST5, SEED, IDEA, and Blowfish
    classes from the cipher module. These are still available in
    :doc:`/hazmat/decrepit/index`.
  * In X.509, when performing a PSS signature with a SHA-3 hash,
    it is now encoded with the official NIST SHA3 OID.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1765195200">- Only require pytest-subtests with pytest &lt; 9.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1770897600">- Update to 46.0.5 (fixes CVE-2026-26007, bsc#1258074)
  * An attacker could create a malicious public key that reveals portions of
    your private key when using certain uncommon elliptic curves (binary
    curves). This version now includes additional security checks to prevent
    this attack. This issue only affects binary elliptic curves, which are
    rarely used in real-world applications. Credit to XlabAI Team of Tencent
    Xuanwu Lab and Atuin Automated Vulnerability Discovery Engine for reporting
    the issue. CVE-2026-26007
  * Support for SECT* binary elliptic curves is deprecated and will be removed
    in the next release.
- Update to 46.0.4
  * Dropped support for win_arm64 wheels.
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.5.
- Update to 46.0.3
  * Fixed compilation when using LibreSSL 4.2.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1774612800">- update to 46.0.6 (CVE-2026-34073, bsc#1260876):
  * SECURITY ISSUE: Fixed a bug where name constraints were not
    applied to peer names during verification when the leaf
    certificate contains a wildcard DNS SAN. Ordinary X.509
    topologies are not affected by this bug, including those used
    by the Web PKI. Credit to Oleh Konko (1seal) for reporting
    the issue. CVE-2026-34073</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1774958400">- Add patch support-maturin-1.12.patch:
  * Correctly deal with maturin bugfix that installs tests and
    docs under sitearch.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1775822400">- Update to 46.0.7 (fixes CVE-2026-39892, bsc#1261863)
  * **SECURITY ISSUE**: Fixed an issue where non-contiguous buffers could be
    passed to APIs that accept Python buffers, which could lead to buffer
    overflow. **CVE-2026-39892**
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.6.
- drop support-maturin-1.12.patch (upstream)
- drop no-pytest_benchmark.patch,
  Make-unsafe-subinterpreter-support-available-via-cfg.patch:
  obsolete</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1777204800">- update to 47.0.0:
  * Support for Python 3.8 is deprecated and will be removed in
    the next cryptography release.
  * BACKWARDS INCOMPATIBLE: Support for binary elliptic curves
    (SECT* classes) has been removed. These curves are rarely
    used and have additional security considerations that make
    them undesirable.
  * BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.1.x has been
    removed. OpenSSL 3.0.0 or later is now required. LibreSSL,
    BoringSSL, and AWS-LC continue to be supported.
  * BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL &lt; 4.1.
  * BACKWARDS INCOMPATIBLE: Loading keys with unsupported
    algorithms or keys with unsupported explicit curve encodings
    now raises
    :class:`~cryptography.exceptions.UnsupportedAlgorithm`
    instead of ValueError. This change affects :func:`~cryptograp
    hy.hazmat.primitives.serialization.load_pem_private_key`, :fu
    nc:`~cryptography.hazmat.primitives.serialization.load_der_pr
    ivate_key`, :func:`~cryptography.hazmat.primitives.serializat
    ion.load_pem_public_key`, :func:`~cryptography.hazmat.primiti
    ves.serialization.load_der_public_key`, and
    :meth:`~cryptography.x509.Certificate.public_key` when called
    on certificates with unsupported public key algorithms.
  * BACKWARDS INCOMPATIBLE: When parsing elliptic curve private
    keys, we now reject keys that incorrectly encode a private
    key of the wrong length because such keys are impossible to
    process in a constant-time manner. We do not believe keys
    with this problem are in wide use, however we may revert this
    change based on the feedback we receive.
  * Deprecated passing 64-bit (8-byte) and 128-bit (16-byte) keys
    to :class:`~cryptography.hazmat.decrepit.ciphers.algorithms.T
    ripleDES`. In a future release, only 192-bit (24-byte) keys
    will be accepted. Users should expand shorter keys themselves
    (e.g., for single DES: key + key + key, for two-key: key +
    key[:8]).
  * Updated the minimum supported Rust version (MSRV) to 1.83.0,
    from 1.74.0.
  * Support for x86_64 macOS (including publishing wheels) is
    deprecated and will be removed in the next release. We will
    switch to publishing an arm64 only wheel for macOS.
  * Support for 32-bit Windows (including publishing wheels) is
    deprecated and will be removed in the next release. Users
    should move to a 64-bit Python installation.
  * public_bytes and private_bytes methods on keys now raise
    TypeError (instead of ValueError) if an invalid encoding is
    provided for the given format.
  * Moved
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.CFB`,
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.OFB`, and
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.CFB8`
    into :doc:`/hazmat/decrepit/index` and deprecated them in the
    modes module. They will be removed from the modes module in
    49.0.0.
  * Moved :class:`~cryptography.hazmat.primitives.ciphers.algorit
    hms.Camellia` into  :doc:`/hazmat/decrepit/index` and
    deprecated it in the cipher module. It will be removed from
    the cipher module in 49.0.0.
  * Added
    :meth:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF.extract`
    to :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF`.
    The previous private implementation will be removed in
    49.0.0.
  * Added support for loading elliptic curve keys that contain
    explicit encodings of the curves secp256r1, secp384r1, and
    secp521r1.
  * Added support for
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2d`
    and
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2i`
    when using OpenSSL 3.2.0+.
  * Added derive_into methods to
    :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF`,
    :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDFExpand`,
    :class:`~cryptography.hazmat.primitives.kdf.concatkdf.ConcatK
    DFHash`, :class:`~cryptography.hazmat.primitives.kdf.concatkd
    f.ConcatKDFHMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2id`,
    :class:`~cryptography.hazmat.primitives.kdf.pbkdf2.PBKDF2HMAC
    `,
    :class:`~cryptography.hazmat.primitives.kdf.kbkdf.KBKDFHMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.kbkdf.KBKDFCMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.scrypt.Scrypt`,
    and
    :class:`~cryptography.hazmat.primitives.kdf.x963kdf.X963KDF`
    to allow deriving keys directly into pre-allocated buffers.
  * Added encrypt_into and decrypt_into methods to
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESCCM`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESGCM`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESGCMSI
    V`, :class:`~cryptography.hazmat.primitives.ciphers.aead.AESO
    CB3`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESSIV`,
    and :class:`~cryptography.hazmat.primitives.ciphers.aead.ChaC
    ha20Poly1305` to allow encrypting directly into a pre-
    allocated buffer.
  * Added support for PKCS1v15 signing without DigestInfo using :
    class:`~cryptography.hazmat.primitives.asymmetric.utils.NoDig
    estInfo`.
  * Added
    :meth:`~cryptography.hazmat.primitives.hashes.Hash.hash`, a
    one-shot method for computing hashes.
  * Added :doc:`/hazmat/primitives/hpke` support implementing RFC
    9180 for hybrid authenticated encryption.
  * Added new :doc:`/hazmat/primitives/asymmetric/mlkem` module
    with support for ML-KEM key encapsulation with AWS-LC and
    BoringSSL. Note: Post-quantum algorithm support requires AWS-
    LC or BoringSSL. As we ship our wheels with OpenSSL, most
    users will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Note: Post-quantum algorithm support requires AWS-LC or
    BoringSSL. As we ship our wheels with OpenSSL, most users
    will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Added new :doc:`/hazmat/primitives/asymmetric/mldsa` module
    with support for ML-DSA signing and verification with AWS-LC
    and BoringSSL. Note: Post-quantum algorithm support requires
    AWS-LC or BoringSSL. As we ship our wheels with OpenSSL, most
    users will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Note: Post-quantum algorithm support requires AWS-LC or
    BoringSSL. As we ship our wheels with OpenSSL, most users
    will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Added new :doc:`/hazmat/asn1/index` module with support for
    declaratively defining custom ASN.1 types and
    encoding/decoding them.
  * Fixed compilation when using LibreSSL 4.3.0 and OpenSSL
    4.0.0.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 4.0.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1778414400">- update to 48.0.0:
  * BACKWARDS INCOMPATIBLE: Support for Python 3.8 has been
    removed. cryptography now requires Python 3.9 or later.
  * BACKWARDS INCOMPATIBLE: Loading an X.509 CRL whose inner
    TBSCertList.signature algorithm does not match the outer
    signatureAlgorithm now raises ValueError. Previously, such
    CRLs were parsed successfully and only rejected during
    signature validation.
  * Added support for :doc:`/hazmat/primitives/asymmetric/mlkem`
    and :doc:`/hazmat/primitives/asymmetric/mldsa` when using
    OpenSSL 3.5.0 or later, in addition to the existing AWS-LC
    and BoringSSL support. This means post-quantum algorithms are
    now available to users of our wheels. Note: Going forward, we
    do not guarantee that all functionality in cryptography will
    be available when building against OpenSSL. See
    :doc:`/statements/state-of-openssl` for more information.
  * Note: Going forward, we do not guarantee that all
    functionality in cryptography will be available when building
    against OpenSSL. See :doc:`/statements/state-of-openssl` for
    more information.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1781438400">- update to 49.0.0:
  * BACKWARDS INCOMPATIBLE: Removed the deprecated
    PUBLIC_KEY_TYPES, PRIVATE_KEY_TYPES,
    CERTIFICATE_PRIVATE_KEY_TYPES,
    CERTIFICATE_ISSUER_PUBLIC_KEY_TYPES, and
    CERTIFICATE_PUBLIC_KEY_TYPES type aliases. Use
    PublicKeyTypes, PrivateKeyTypes,
    CertificateIssuerPrivateKeyTypes,
    CertificateIssuerPublicKeyTypes, and
    CertificatePublicKeyTypes instead. These were deprecated in
    version 40.0.
  * BACKWARDS INCOMPATIBLE: :class:`~cryptography.hazmat.primitiv
    es.ciphers.algorithms.ChaCha20` now treats the first 4 bytes
    of the nonce as a 32-bit little-endian block counter (as
    defined in RFC 7539) and tracks the number of bytes
    processed. Attempting to encrypt or decrypt more data than
    the counter allows before it would overflow now raises a
    :class:`ValueError` rather than silently diverging from RFC
    7539. Setting the counter portion of the nonce to zero allows
    encrypting up to 256 GiB with a given nonce.
  * BACKWARDS INCOMPATIBLE: Loading an X.509 certificate whose
    ECDSA or DSA signature AlgorithmIdentifier contains encoded
    NULL parameters now raises a :class:`ValueError`. Such
    certificates are invalid, but older versions of Java emitted
    them; previously they loaded with a deprecation warning.
  * Fixed cross-compilation of the CFFI bindings when
    PYO3_CROSS_LIB_DIR is set. The build now derives the Python
    include directory from PYO3_CROSS_LIB_DIR instead of querying
    the host interpreter, which previously caused the build to
    fail during cross-compilations for embedded systems, on hosts
    which have same-version Python development headers installed
    as the target Python.
  * Added support for signing and verifying X.509 certificates,
    certificate signing requests, and certificate revocation
    lists with :doc:`/hazmat/primitives/asymmetric/mldsa` keys,
    as well as loading certificates that contain ML-DSA public
    keys.
  * Added
    :meth:`~cryptography.hazmat.primitives.hpke.KEM.enc_length`
    to :class:`~cryptography.hazmat.primitives.hpke.KEM` so
    callers can split the encapsulated key from the ciphertext
    returned by
    :meth:`~cryptography.hazmat.primitives.hpke.Suite.encrypt`.
  * :meth:`~cryptography.x509.verification.ExtensionPolicy.requir
    e_present`, :meth:`~cryptography.x509.verification.ExtensionP
    olicy.may_be_present`, and :meth:`~cryptography.x509.verifica
    tion.ExtensionPolicy.require_not_present` now accept any
    extension type. Previously only a fixed set of extension
    types was supported, which made it impossible to account for
    otherwise unrecognized critical extensions during path
    validation.
  * Added support for using
    :class:`~cryptography.x509.Certificate`,
    :class:`~cryptography.x509.CertificateSigningRequest`, and
    :class:`~cryptography.x509.CertificateRevocationList` as
    field types in :doc:`/hazmat/asn1/index` structures.
  * Added :func:`~cryptography.hazmat.asn1.value_set`, a class
    decorator that registers an :class:`enum.Enum` subclass as an
    ASN.1 value set: members are encoded as their underlying
    value, and decoding fails if the decoded value does not match
    one of the declared members.
  * Added :meth:`~cryptography.x509.Name.from_bytes` for parsing
    a :class:`~cryptography.x509.Name` from DER bytes, the
    inverse of :meth:`~cryptography.x509.Name.public_bytes`.
  * Added the rsa_padding keyword-only parameter to
    :meth:`~cryptography.x509.CertificateBuilder.public_key`.
    Passing the :class:`~cryptography.hazmat.primitives.asymmetri
    c.padding.PSS` class (not an instance) encodes an RSA subject
    public key in the certificate's subjectPublicKeyInfo with the
    id-RSASSA-PSS OID and no parameters.
  * Added external mu (message representative) support to
    :doc:`/hazmat/primitives/asymmetric/mldsa` via the sign_mu
    and verify_mu methods, which sign and verify a precomputed
    64-byte mu as defined in FIPS 204.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 4.0.1.</changelog>
</package>
<package pkgid="e234b1576cd71e21baee974c02f17fe72ac905d208477ff4ee43d38b25549e6f0575f7f3612c8b96b09ad6a50367c9ddeb1476364a0a06d5685a1cc9f954e39c" name="python311-cryptography-debuginfo" arch="armv7hl">
  <version epoch="0" ver="49.0.0" rel="289.3"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1727524800">- update to 43.0.1:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.3.2.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1729598400">- update to 43.0.3:
  * Fixed release metadata for cryptography-vectors
  * Fixed compilation when using LibreSSL 4.0.0.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1730808000">- Avoid using requires_eq, which after the last modifications
  conflicts with python singlespec (order of expansion).</changelog>
  <changelog author="Ben Greiner &lt;code@bnavigator.de&gt;" date="1731067200">- Fix requires_eq replacement for distributions which do not have
  python3-cffi installed (such as SLE15 python module pythons)
  * gh#openSUSE/python-rpm-macros#185
- Remove outdated section in description</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfyhalomacro@opensuse.org&gt;" date="1737892800">- Update to version 44.0.0:
  * BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL &lt; 3.9.
  * Deprecated Python 3.7 support. Python 3.7 is no longer supported by
    the Python core team. Support for Python 3.7 will be removed in a future
    cryptography release.
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.4.0.
  * macOS wheels are now built against the macOS 10.13 SDK. Users on older
    versions of macOS should upgrade, or they will need to build cryptography
    themselves.
  * Enforce the RFC 5280 requirement that extended key usage extensions must not be empty.
  * Added support for timestamp extraction to the :class:`~cryptography.fernet.MultiFernet` class.
  * Relax the Authority Key Identifier requirements on root CA certificates
    during X.509 verification to allow fields permitted by RFC 5280 but
    forbidden by the CA/Browser BRs.
  * Added support for
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2id` when using
    OpenSSL 3.2.0+.
  * Added support for the :class:`~cryptography.x509.Admissions` certificate extension.
  * Added basic support for PKCS7 decryption (including S/MIME 3.2) via
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der`,
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_pem`,
    and :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_smime`.
- Update specfile to accommodate new project structure at version 44.0.0
- Update no-pytest_benchmark.patch</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1740571200">- update to 44.0.1:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.4.1.
  * We now build armv7l manylinux wheels and publish them to
    PyPI.
  * We now build manylinux_2_34 wheels and publish them to PyPI.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1742731200">- update to 44.0.2:
  * We now build wheels for PyPy 3.11.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1746619200">- Update to 44.0.3
  * Fixed compilation when using LibreSSL 4.1.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1752321600">- update to 45.0.5:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.1.
  * Fixed decrypting PKCS#8 files encrypted with SHA1-RC4. (This
    is not considered secure, and is supported only for backwards
    compatibility.)
  * Fixed decrypting PKCS#8 files encrypted with long salts (this
    impacts keys encrypted by Bouncy Castle).
  * Fixed decrypting PKCS#8 files encrypted with DES-CBC-MD5.
    While wildly insecure, this remains prevalent.
  * Fixed using mypy with cryptography on older versions of
    Python.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.0.
  * Support for Python 3.7 is deprecated and will be removed in
    the next cryptography release.
  * Updated the minimum supported Rust version (MSRV) to 1.74.0,
    from 1.65.0.
  * Added support for serialization of PKCS#12 Java truststores
    in :func:`~cryptography.hazmat.primitives.serialization.pkcs1
    2.serialize_java_truststore`
  * Added :meth:`~cryptography.hazmat.primitives.kdf.argon2.Argon
    2id.derive_phc_encoded` and :meth:`~cryptography.hazmat.primi
    tives.kdf.argon2.Argon2id.verify_phc_encoded` methods to
    support password hashing in the PHC string format
  * Added support for PKCS7 decryption and encryption using
    AES-256 as the content algorithm, in addition to AES-128.
  * BACKWARDS INCOMPATIBLE: Made SSH private key loading more
    consistent with other private key loading: :func:`~cryptograp
    hy.hazmat.primitives.serialization.load_ssh_private_key` now
    raises a TypeError if the key is unencrypted but a password
    is provided (previously no exception was raised), and raises
    a TypeError if the key is encrypted but no password is
    provided (previously a ValueError was raised).
  * Added __copy__ to the :class:`~cryptography.hazmat.primitives
    .asymmetric.ec.EllipticCurvePrivateKey`, :class:`~cryptograph
    y.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey`, :c
    lass:`~cryptography.hazmat.primitives.asymmetric.ed25519.Ed25
    519PublicKey`, :class:`~cryptography.hazmat.primitives.asymme
    tric.ed25519.Ed25519PrivateKey`, :class:`~cryptography.hazmat
    .primitives.asymmetric.ed448.Ed448PublicKey`, :class:`~crypto
    graphy.hazmat.primitives.asymmetric.ed448.Ed448PrivateKey`, :
    class:`~cryptography.hazmat.primitives.asymmetric.x25519.X255
    19PublicKey`, :class:`~cryptography.hazmat.primitives.asymmet
    ric.x25519.X25519PrivateKey`, :class:`~cryptography.hazmat.pr
    imitives.asymmetric.x448.X448PublicKey`, :class:`~cryptograph
    y.hazmat.primitives.asymmetric.x448.X448PrivateKey`, :class:`
    ~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey`
    , :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAP
    ublicKey`, :class:`~cryptography.hazmat.primitives.asymmetric
    .dsa.DSAPrivateKey`, :class:`~cryptography.hazmat.primitives.
    asymmetric.dsa.DSAPublicKey`, :class:`~cryptography.hazmat.pr
    imitives.asymmetric.dh.DHPrivateKey`, and :class:`~cryptograp
    hy.hazmat.primitives.asymmetric.dh.DHPublicKey` abstract base
    classes.
  * We significantly refactored how private key loading ( :func:`
    ~cryptography.hazmat.primitives.serialization.load_pem_privat
    e_key` and :func:`~cryptography.hazmat.primitives.serializati
    on.load_der_private_key`) works. This is intended to be
    backwards compatible for all well-formed keys, therefore if
    you discover a key that now raises an exception, please file
    a bug with instructions for reproducing.
  * Added unsafe_skip_rsa_key_validation keyword-argument to :fun
    c:`~cryptography.hazmat.primitives.serialization.load_ssh_pri
    vate_key`.
  * Added :class:`~cryptography.hazmat.primitives.hashes.XOFHash`
    to support repeated :meth:`~cryptography.hazmat.primitives.ha
    shes.XOFHash.squeeze` operations on extendable output
    functions.
  * Added :meth:`~cryptography.x509.ocsp.OCSPResponseBuilder.add_
    response_by_hash` method to allow creating OCSP responses
    using certificate hash values rather than full certificates.
  * Extended the :mod:`X.509 path validation
    &lt;cryptography.x509.verification&gt;` API to support user-
    configured extension policies via the
    :meth:`PolicyBuilder.extension_policies &lt;cryptography.x509.ve
    rification.PolicyBuilder.extension_policies&gt;` method.
  * Deprecated the subject, verification_time and max_chain_depth
    properties on
    :class:`~cryptography.x509.verification.ClientVerifier` and
    :class:`~cryptography.x509.verification.ServerVerifier` in
    favor of a new policy property. These properties will be
    removed in the next release of cryptography.
  * BACKWARDS INCOMPATIBLE: The :meth:`VerifiedClient.subject
    &lt;cryptography.x509.verification.VerifiedClient.subjects&gt;`
    property can now be None since a custom extension policy may
    allow certificates without a Subject Alternative Name
    extension.
  * Changed the behavior when the OpenSSL 3 legacy provider fails
    to load. Instead of raising an exception, a warning is now
    emitted. The CRYPTOGRAPHY_OPENSSL_NO_LEGACY environment
    variable can still be used to disable the legacy provider at
    runtime.
  * Added support for the CRYPTOGRAPHY_BUILD_OPENSSL_NO_LEGACY
    environment variable during build time, which prevents the
    library from ever attempting to load the legacy provider.
  * Added support for the
    :class:`~cryptography.x509.PrivateKeyUsagePeriod` X.509
    extension. This extension defines the period during which the
    private key corresponding to the certificate's public key may
    be used.
  * Added support for compiling against `aws-lc`_.
  * Parsing X.509 structures now more strictly enforces that Name
    structures do not have malformed ASN.1.
  * We now publish py311 wheels that utilize the faster
    pyo3::buffer::PyBuffer interface, resulting in significantly
    improved performance for operations involving small buffers.
  * Added :func:`~cryptography.hazmat.primitives.serialization.ss
    h_key_fingerprint` for computing fingerprints of SSH public
    keys.
  * Added support for deterministic ECDSA signing via the new
    keyword-only argument ecdsa_deterministic in
    :meth:`~cryptography.x509.CertificateBuilder.sign`, :meth:`~c
    ryptography.x509.CertificateRevocationListBuilder.sign` and :
    meth:`~cryptography.x509.CertificateSigningRequestBuilder.sig
    n`.</changelog>
  <changelog author="James Oakley &lt;jfunk@opensuse.org&gt;" date="1756728000">- Add Make-unsafe-subinterpreter-support-available-via-cfg.patch
  to allow ceph-mgr to load modules (boo#1248987)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1757851200">- update to 45.0.7:
  * Added a function to support an upcoming pyOpenSSL release.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1760356800">- update to 46.0.2:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.4.
  * Fixed an issue where users installing via pip on Python 3.14
    development versions would not properly install a dependency.
  * Fixed an issue building the free-threaded macOS 3.14 wheels.
  * BACKWARDS INCOMPATIBLE: Support for Python 3.7 has been
    removed.
  * Support for OpenSSL &lt; 3.0 is deprecated and will be removed
    in the next release.
  * Support for x86_64 macOS (including publishing wheels) is
    deprecated and will be removed in two releases. We will
    switch to publishing an arm64 only wheel for macOS.
  * Support for 32-bit Windows (including publishing wheels) is
    deprecated and will be removed in two releases. Users should
    move to a 64-bit Python installation.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.3.
  * We now build ppc64le manylinux wheels and publish them to
    PyPI.
  * We now build win_arm64 (Windows on Arm) wheels and publish
    them to PyPI.
  * Added support for free-threaded Python 3.14.
  * Removed the deprecated get_attribute_for_oid method on
    :class:`~cryptography.x509.CertificateSigningRequest`. Users
    should use
    :meth:`~cryptography.x509.Attributes.get_attribute_for_oid`
    instead.
  * Removed the deprecated CAST5, SEED, IDEA, and Blowfish
    classes from the cipher module. These are still available in
    :doc:`/hazmat/decrepit/index`.
  * In X.509, when performing a PSS signature with a SHA-3 hash,
    it is now encoded with the official NIST SHA3 OID.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1765195200">- Only require pytest-subtests with pytest &lt; 9.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1770897600">- Update to 46.0.5 (fixes CVE-2026-26007, bsc#1258074)
  * An attacker could create a malicious public key that reveals portions of
    your private key when using certain uncommon elliptic curves (binary
    curves). This version now includes additional security checks to prevent
    this attack. This issue only affects binary elliptic curves, which are
    rarely used in real-world applications. Credit to XlabAI Team of Tencent
    Xuanwu Lab and Atuin Automated Vulnerability Discovery Engine for reporting
    the issue. CVE-2026-26007
  * Support for SECT* binary elliptic curves is deprecated and will be removed
    in the next release.
- Update to 46.0.4
  * Dropped support for win_arm64 wheels.
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.5.
- Update to 46.0.3
  * Fixed compilation when using LibreSSL 4.2.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1774612800">- update to 46.0.6 (CVE-2026-34073, bsc#1260876):
  * SECURITY ISSUE: Fixed a bug where name constraints were not
    applied to peer names during verification when the leaf
    certificate contains a wildcard DNS SAN. Ordinary X.509
    topologies are not affected by this bug, including those used
    by the Web PKI. Credit to Oleh Konko (1seal) for reporting
    the issue. CVE-2026-34073</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1774958400">- Add patch support-maturin-1.12.patch:
  * Correctly deal with maturin bugfix that installs tests and
    docs under sitearch.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1775822400">- Update to 46.0.7 (fixes CVE-2026-39892, bsc#1261863)
  * **SECURITY ISSUE**: Fixed an issue where non-contiguous buffers could be
    passed to APIs that accept Python buffers, which could lead to buffer
    overflow. **CVE-2026-39892**
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.6.
- drop support-maturin-1.12.patch (upstream)
- drop no-pytest_benchmark.patch,
  Make-unsafe-subinterpreter-support-available-via-cfg.patch:
  obsolete</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1777204800">- update to 47.0.0:
  * Support for Python 3.8 is deprecated and will be removed in
    the next cryptography release.
  * BACKWARDS INCOMPATIBLE: Support for binary elliptic curves
    (SECT* classes) has been removed. These curves are rarely
    used and have additional security considerations that make
    them undesirable.
  * BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.1.x has been
    removed. OpenSSL 3.0.0 or later is now required. LibreSSL,
    BoringSSL, and AWS-LC continue to be supported.
  * BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL &lt; 4.1.
  * BACKWARDS INCOMPATIBLE: Loading keys with unsupported
    algorithms or keys with unsupported explicit curve encodings
    now raises
    :class:`~cryptography.exceptions.UnsupportedAlgorithm`
    instead of ValueError. This change affects :func:`~cryptograp
    hy.hazmat.primitives.serialization.load_pem_private_key`, :fu
    nc:`~cryptography.hazmat.primitives.serialization.load_der_pr
    ivate_key`, :func:`~cryptography.hazmat.primitives.serializat
    ion.load_pem_public_key`, :func:`~cryptography.hazmat.primiti
    ves.serialization.load_der_public_key`, and
    :meth:`~cryptography.x509.Certificate.public_key` when called
    on certificates with unsupported public key algorithms.
  * BACKWARDS INCOMPATIBLE: When parsing elliptic curve private
    keys, we now reject keys that incorrectly encode a private
    key of the wrong length because such keys are impossible to
    process in a constant-time manner. We do not believe keys
    with this problem are in wide use, however we may revert this
    change based on the feedback we receive.
  * Deprecated passing 64-bit (8-byte) and 128-bit (16-byte) keys
    to :class:`~cryptography.hazmat.decrepit.ciphers.algorithms.T
    ripleDES`. In a future release, only 192-bit (24-byte) keys
    will be accepted. Users should expand shorter keys themselves
    (e.g., for single DES: key + key + key, for two-key: key +
    key[:8]).
  * Updated the minimum supported Rust version (MSRV) to 1.83.0,
    from 1.74.0.
  * Support for x86_64 macOS (including publishing wheels) is
    deprecated and will be removed in the next release. We will
    switch to publishing an arm64 only wheel for macOS.
  * Support for 32-bit Windows (including publishing wheels) is
    deprecated and will be removed in the next release. Users
    should move to a 64-bit Python installation.
  * public_bytes and private_bytes methods on keys now raise
    TypeError (instead of ValueError) if an invalid encoding is
    provided for the given format.
  * Moved
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.CFB`,
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.OFB`, and
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.CFB8`
    into :doc:`/hazmat/decrepit/index` and deprecated them in the
    modes module. They will be removed from the modes module in
    49.0.0.
  * Moved :class:`~cryptography.hazmat.primitives.ciphers.algorit
    hms.Camellia` into  :doc:`/hazmat/decrepit/index` and
    deprecated it in the cipher module. It will be removed from
    the cipher module in 49.0.0.
  * Added
    :meth:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF.extract`
    to :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF`.
    The previous private implementation will be removed in
    49.0.0.
  * Added support for loading elliptic curve keys that contain
    explicit encodings of the curves secp256r1, secp384r1, and
    secp521r1.
  * Added support for
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2d`
    and
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2i`
    when using OpenSSL 3.2.0+.
  * Added derive_into methods to
    :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF`,
    :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDFExpand`,
    :class:`~cryptography.hazmat.primitives.kdf.concatkdf.ConcatK
    DFHash`, :class:`~cryptography.hazmat.primitives.kdf.concatkd
    f.ConcatKDFHMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2id`,
    :class:`~cryptography.hazmat.primitives.kdf.pbkdf2.PBKDF2HMAC
    `,
    :class:`~cryptography.hazmat.primitives.kdf.kbkdf.KBKDFHMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.kbkdf.KBKDFCMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.scrypt.Scrypt`,
    and
    :class:`~cryptography.hazmat.primitives.kdf.x963kdf.X963KDF`
    to allow deriving keys directly into pre-allocated buffers.
  * Added encrypt_into and decrypt_into methods to
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESCCM`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESGCM`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESGCMSI
    V`, :class:`~cryptography.hazmat.primitives.ciphers.aead.AESO
    CB3`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESSIV`,
    and :class:`~cryptography.hazmat.primitives.ciphers.aead.ChaC
    ha20Poly1305` to allow encrypting directly into a pre-
    allocated buffer.
  * Added support for PKCS1v15 signing without DigestInfo using :
    class:`~cryptography.hazmat.primitives.asymmetric.utils.NoDig
    estInfo`.
  * Added
    :meth:`~cryptography.hazmat.primitives.hashes.Hash.hash`, a
    one-shot method for computing hashes.
  * Added :doc:`/hazmat/primitives/hpke` support implementing RFC
    9180 for hybrid authenticated encryption.
  * Added new :doc:`/hazmat/primitives/asymmetric/mlkem` module
    with support for ML-KEM key encapsulation with AWS-LC and
    BoringSSL. Note: Post-quantum algorithm support requires AWS-
    LC or BoringSSL. As we ship our wheels with OpenSSL, most
    users will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Note: Post-quantum algorithm support requires AWS-LC or
    BoringSSL. As we ship our wheels with OpenSSL, most users
    will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Added new :doc:`/hazmat/primitives/asymmetric/mldsa` module
    with support for ML-DSA signing and verification with AWS-LC
    and BoringSSL. Note: Post-quantum algorithm support requires
    AWS-LC or BoringSSL. As we ship our wheels with OpenSSL, most
    users will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Note: Post-quantum algorithm support requires AWS-LC or
    BoringSSL. As we ship our wheels with OpenSSL, most users
    will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Added new :doc:`/hazmat/asn1/index` module with support for
    declaratively defining custom ASN.1 types and
    encoding/decoding them.
  * Fixed compilation when using LibreSSL 4.3.0 and OpenSSL
    4.0.0.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 4.0.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1778414400">- update to 48.0.0:
  * BACKWARDS INCOMPATIBLE: Support for Python 3.8 has been
    removed. cryptography now requires Python 3.9 or later.
  * BACKWARDS INCOMPATIBLE: Loading an X.509 CRL whose inner
    TBSCertList.signature algorithm does not match the outer
    signatureAlgorithm now raises ValueError. Previously, such
    CRLs were parsed successfully and only rejected during
    signature validation.
  * Added support for :doc:`/hazmat/primitives/asymmetric/mlkem`
    and :doc:`/hazmat/primitives/asymmetric/mldsa` when using
    OpenSSL 3.5.0 or later, in addition to the existing AWS-LC
    and BoringSSL support. This means post-quantum algorithms are
    now available to users of our wheels. Note: Going forward, we
    do not guarantee that all functionality in cryptography will
    be available when building against OpenSSL. See
    :doc:`/statements/state-of-openssl` for more information.
  * Note: Going forward, we do not guarantee that all
    functionality in cryptography will be available when building
    against OpenSSL. See :doc:`/statements/state-of-openssl` for
    more information.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1781438400">- update to 49.0.0:
  * BACKWARDS INCOMPATIBLE: Removed the deprecated
    PUBLIC_KEY_TYPES, PRIVATE_KEY_TYPES,
    CERTIFICATE_PRIVATE_KEY_TYPES,
    CERTIFICATE_ISSUER_PUBLIC_KEY_TYPES, and
    CERTIFICATE_PUBLIC_KEY_TYPES type aliases. Use
    PublicKeyTypes, PrivateKeyTypes,
    CertificateIssuerPrivateKeyTypes,
    CertificateIssuerPublicKeyTypes, and
    CertificatePublicKeyTypes instead. These were deprecated in
    version 40.0.
  * BACKWARDS INCOMPATIBLE: :class:`~cryptography.hazmat.primitiv
    es.ciphers.algorithms.ChaCha20` now treats the first 4 bytes
    of the nonce as a 32-bit little-endian block counter (as
    defined in RFC 7539) and tracks the number of bytes
    processed. Attempting to encrypt or decrypt more data than
    the counter allows before it would overflow now raises a
    :class:`ValueError` rather than silently diverging from RFC
    7539. Setting the counter portion of the nonce to zero allows
    encrypting up to 256 GiB with a given nonce.
  * BACKWARDS INCOMPATIBLE: Loading an X.509 certificate whose
    ECDSA or DSA signature AlgorithmIdentifier contains encoded
    NULL parameters now raises a :class:`ValueError`. Such
    certificates are invalid, but older versions of Java emitted
    them; previously they loaded with a deprecation warning.
  * Fixed cross-compilation of the CFFI bindings when
    PYO3_CROSS_LIB_DIR is set. The build now derives the Python
    include directory from PYO3_CROSS_LIB_DIR instead of querying
    the host interpreter, which previously caused the build to
    fail during cross-compilations for embedded systems, on hosts
    which have same-version Python development headers installed
    as the target Python.
  * Added support for signing and verifying X.509 certificates,
    certificate signing requests, and certificate revocation
    lists with :doc:`/hazmat/primitives/asymmetric/mldsa` keys,
    as well as loading certificates that contain ML-DSA public
    keys.
  * Added
    :meth:`~cryptography.hazmat.primitives.hpke.KEM.enc_length`
    to :class:`~cryptography.hazmat.primitives.hpke.KEM` so
    callers can split the encapsulated key from the ciphertext
    returned by
    :meth:`~cryptography.hazmat.primitives.hpke.Suite.encrypt`.
  * :meth:`~cryptography.x509.verification.ExtensionPolicy.requir
    e_present`, :meth:`~cryptography.x509.verification.ExtensionP
    olicy.may_be_present`, and :meth:`~cryptography.x509.verifica
    tion.ExtensionPolicy.require_not_present` now accept any
    extension type. Previously only a fixed set of extension
    types was supported, which made it impossible to account for
    otherwise unrecognized critical extensions during path
    validation.
  * Added support for using
    :class:`~cryptography.x509.Certificate`,
    :class:`~cryptography.x509.CertificateSigningRequest`, and
    :class:`~cryptography.x509.CertificateRevocationList` as
    field types in :doc:`/hazmat/asn1/index` structures.
  * Added :func:`~cryptography.hazmat.asn1.value_set`, a class
    decorator that registers an :class:`enum.Enum` subclass as an
    ASN.1 value set: members are encoded as their underlying
    value, and decoding fails if the decoded value does not match
    one of the declared members.
  * Added :meth:`~cryptography.x509.Name.from_bytes` for parsing
    a :class:`~cryptography.x509.Name` from DER bytes, the
    inverse of :meth:`~cryptography.x509.Name.public_bytes`.
  * Added the rsa_padding keyword-only parameter to
    :meth:`~cryptography.x509.CertificateBuilder.public_key`.
    Passing the :class:`~cryptography.hazmat.primitives.asymmetri
    c.padding.PSS` class (not an instance) encodes an RSA subject
    public key in the certificate's subjectPublicKeyInfo with the
    id-RSASSA-PSS OID and no parameters.
  * Added external mu (message representative) support to
    :doc:`/hazmat/primitives/asymmetric/mldsa` via the sign_mu
    and verify_mu methods, which sign and verify a precomputed
    64-byte mu as defined in FIPS 204.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 4.0.1.</changelog>
</package>
<package pkgid="19561648cca8e54fb1135796ee3aaf9fd719cd154ae40c3c4eef146fc49d97589f81d2829615ae7c1d2ce55f13c5388548a496fe13ffb069c6484a0c55c78782" name="python311-cryptography-debuginfo" arch="x86_64">
  <version epoch="0" ver="49.0.0" rel="289.3"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1727524800">- update to 43.0.1:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.3.2.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1729598400">- update to 43.0.3:
  * Fixed release metadata for cryptography-vectors
  * Fixed compilation when using LibreSSL 4.0.0.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1730808000">- Avoid using requires_eq, which after the last modifications
  conflicts with python singlespec (order of expansion).</changelog>
  <changelog author="Ben Greiner &lt;code@bnavigator.de&gt;" date="1731067200">- Fix requires_eq replacement for distributions which do not have
  python3-cffi installed (such as SLE15 python module pythons)
  * gh#openSUSE/python-rpm-macros#185
- Remove outdated section in description</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfyhalomacro@opensuse.org&gt;" date="1737892800">- Update to version 44.0.0:
  * BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL &lt; 3.9.
  * Deprecated Python 3.7 support. Python 3.7 is no longer supported by
    the Python core team. Support for Python 3.7 will be removed in a future
    cryptography release.
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.4.0.
  * macOS wheels are now built against the macOS 10.13 SDK. Users on older
    versions of macOS should upgrade, or they will need to build cryptography
    themselves.
  * Enforce the RFC 5280 requirement that extended key usage extensions must not be empty.
  * Added support for timestamp extraction to the :class:`~cryptography.fernet.MultiFernet` class.
  * Relax the Authority Key Identifier requirements on root CA certificates
    during X.509 verification to allow fields permitted by RFC 5280 but
    forbidden by the CA/Browser BRs.
  * Added support for
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2id` when using
    OpenSSL 3.2.0+.
  * Added support for the :class:`~cryptography.x509.Admissions` certificate extension.
  * Added basic support for PKCS7 decryption (including S/MIME 3.2) via
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der`,
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_pem`,
    and :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_smime`.
- Update specfile to accommodate new project structure at version 44.0.0
- Update no-pytest_benchmark.patch</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1740571200">- update to 44.0.1:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.4.1.
  * We now build armv7l manylinux wheels and publish them to
    PyPI.
  * We now build manylinux_2_34 wheels and publish them to PyPI.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1742731200">- update to 44.0.2:
  * We now build wheels for PyPy 3.11.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1746619200">- Update to 44.0.3
  * Fixed compilation when using LibreSSL 4.1.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1752321600">- update to 45.0.5:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.1.
  * Fixed decrypting PKCS#8 files encrypted with SHA1-RC4. (This
    is not considered secure, and is supported only for backwards
    compatibility.)
  * Fixed decrypting PKCS#8 files encrypted with long salts (this
    impacts keys encrypted by Bouncy Castle).
  * Fixed decrypting PKCS#8 files encrypted with DES-CBC-MD5.
    While wildly insecure, this remains prevalent.
  * Fixed using mypy with cryptography on older versions of
    Python.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.0.
  * Support for Python 3.7 is deprecated and will be removed in
    the next cryptography release.
  * Updated the minimum supported Rust version (MSRV) to 1.74.0,
    from 1.65.0.
  * Added support for serialization of PKCS#12 Java truststores
    in :func:`~cryptography.hazmat.primitives.serialization.pkcs1
    2.serialize_java_truststore`
  * Added :meth:`~cryptography.hazmat.primitives.kdf.argon2.Argon
    2id.derive_phc_encoded` and :meth:`~cryptography.hazmat.primi
    tives.kdf.argon2.Argon2id.verify_phc_encoded` methods to
    support password hashing in the PHC string format
  * Added support for PKCS7 decryption and encryption using
    AES-256 as the content algorithm, in addition to AES-128.
  * BACKWARDS INCOMPATIBLE: Made SSH private key loading more
    consistent with other private key loading: :func:`~cryptograp
    hy.hazmat.primitives.serialization.load_ssh_private_key` now
    raises a TypeError if the key is unencrypted but a password
    is provided (previously no exception was raised), and raises
    a TypeError if the key is encrypted but no password is
    provided (previously a ValueError was raised).
  * Added __copy__ to the :class:`~cryptography.hazmat.primitives
    .asymmetric.ec.EllipticCurvePrivateKey`, :class:`~cryptograph
    y.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey`, :c
    lass:`~cryptography.hazmat.primitives.asymmetric.ed25519.Ed25
    519PublicKey`, :class:`~cryptography.hazmat.primitives.asymme
    tric.ed25519.Ed25519PrivateKey`, :class:`~cryptography.hazmat
    .primitives.asymmetric.ed448.Ed448PublicKey`, :class:`~crypto
    graphy.hazmat.primitives.asymmetric.ed448.Ed448PrivateKey`, :
    class:`~cryptography.hazmat.primitives.asymmetric.x25519.X255
    19PublicKey`, :class:`~cryptography.hazmat.primitives.asymmet
    ric.x25519.X25519PrivateKey`, :class:`~cryptography.hazmat.pr
    imitives.asymmetric.x448.X448PublicKey`, :class:`~cryptograph
    y.hazmat.primitives.asymmetric.x448.X448PrivateKey`, :class:`
    ~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey`
    , :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAP
    ublicKey`, :class:`~cryptography.hazmat.primitives.asymmetric
    .dsa.DSAPrivateKey`, :class:`~cryptography.hazmat.primitives.
    asymmetric.dsa.DSAPublicKey`, :class:`~cryptography.hazmat.pr
    imitives.asymmetric.dh.DHPrivateKey`, and :class:`~cryptograp
    hy.hazmat.primitives.asymmetric.dh.DHPublicKey` abstract base
    classes.
  * We significantly refactored how private key loading ( :func:`
    ~cryptography.hazmat.primitives.serialization.load_pem_privat
    e_key` and :func:`~cryptography.hazmat.primitives.serializati
    on.load_der_private_key`) works. This is intended to be
    backwards compatible for all well-formed keys, therefore if
    you discover a key that now raises an exception, please file
    a bug with instructions for reproducing.
  * Added unsafe_skip_rsa_key_validation keyword-argument to :fun
    c:`~cryptography.hazmat.primitives.serialization.load_ssh_pri
    vate_key`.
  * Added :class:`~cryptography.hazmat.primitives.hashes.XOFHash`
    to support repeated :meth:`~cryptography.hazmat.primitives.ha
    shes.XOFHash.squeeze` operations on extendable output
    functions.
  * Added :meth:`~cryptography.x509.ocsp.OCSPResponseBuilder.add_
    response_by_hash` method to allow creating OCSP responses
    using certificate hash values rather than full certificates.
  * Extended the :mod:`X.509 path validation
    &lt;cryptography.x509.verification&gt;` API to support user-
    configured extension policies via the
    :meth:`PolicyBuilder.extension_policies &lt;cryptography.x509.ve
    rification.PolicyBuilder.extension_policies&gt;` method.
  * Deprecated the subject, verification_time and max_chain_depth
    properties on
    :class:`~cryptography.x509.verification.ClientVerifier` and
    :class:`~cryptography.x509.verification.ServerVerifier` in
    favor of a new policy property. These properties will be
    removed in the next release of cryptography.
  * BACKWARDS INCOMPATIBLE: The :meth:`VerifiedClient.subject
    &lt;cryptography.x509.verification.VerifiedClient.subjects&gt;`
    property can now be None since a custom extension policy may
    allow certificates without a Subject Alternative Name
    extension.
  * Changed the behavior when the OpenSSL 3 legacy provider fails
    to load. Instead of raising an exception, a warning is now
    emitted. The CRYPTOGRAPHY_OPENSSL_NO_LEGACY environment
    variable can still be used to disable the legacy provider at
    runtime.
  * Added support for the CRYPTOGRAPHY_BUILD_OPENSSL_NO_LEGACY
    environment variable during build time, which prevents the
    library from ever attempting to load the legacy provider.
  * Added support for the
    :class:`~cryptography.x509.PrivateKeyUsagePeriod` X.509
    extension. This extension defines the period during which the
    private key corresponding to the certificate's public key may
    be used.
  * Added support for compiling against `aws-lc`_.
  * Parsing X.509 structures now more strictly enforces that Name
    structures do not have malformed ASN.1.
  * We now publish py311 wheels that utilize the faster
    pyo3::buffer::PyBuffer interface, resulting in significantly
    improved performance for operations involving small buffers.
  * Added :func:`~cryptography.hazmat.primitives.serialization.ss
    h_key_fingerprint` for computing fingerprints of SSH public
    keys.
  * Added support for deterministic ECDSA signing via the new
    keyword-only argument ecdsa_deterministic in
    :meth:`~cryptography.x509.CertificateBuilder.sign`, :meth:`~c
    ryptography.x509.CertificateRevocationListBuilder.sign` and :
    meth:`~cryptography.x509.CertificateSigningRequestBuilder.sig
    n`.</changelog>
  <changelog author="James Oakley &lt;jfunk@opensuse.org&gt;" date="1756728000">- Add Make-unsafe-subinterpreter-support-available-via-cfg.patch
  to allow ceph-mgr to load modules (boo#1248987)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1757851200">- update to 45.0.7:
  * Added a function to support an upcoming pyOpenSSL release.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1760356800">- update to 46.0.2:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.4.
  * Fixed an issue where users installing via pip on Python 3.14
    development versions would not properly install a dependency.
  * Fixed an issue building the free-threaded macOS 3.14 wheels.
  * BACKWARDS INCOMPATIBLE: Support for Python 3.7 has been
    removed.
  * Support for OpenSSL &lt; 3.0 is deprecated and will be removed
    in the next release.
  * Support for x86_64 macOS (including publishing wheels) is
    deprecated and will be removed in two releases. We will
    switch to publishing an arm64 only wheel for macOS.
  * Support for 32-bit Windows (including publishing wheels) is
    deprecated and will be removed in two releases. Users should
    move to a 64-bit Python installation.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.3.
  * We now build ppc64le manylinux wheels and publish them to
    PyPI.
  * We now build win_arm64 (Windows on Arm) wheels and publish
    them to PyPI.
  * Added support for free-threaded Python 3.14.
  * Removed the deprecated get_attribute_for_oid method on
    :class:`~cryptography.x509.CertificateSigningRequest`. Users
    should use
    :meth:`~cryptography.x509.Attributes.get_attribute_for_oid`
    instead.
  * Removed the deprecated CAST5, SEED, IDEA, and Blowfish
    classes from the cipher module. These are still available in
    :doc:`/hazmat/decrepit/index`.
  * In X.509, when performing a PSS signature with a SHA-3 hash,
    it is now encoded with the official NIST SHA3 OID.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1765195200">- Only require pytest-subtests with pytest &lt; 9.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1770897600">- Update to 46.0.5 (fixes CVE-2026-26007, bsc#1258074)
  * An attacker could create a malicious public key that reveals portions of
    your private key when using certain uncommon elliptic curves (binary
    curves). This version now includes additional security checks to prevent
    this attack. This issue only affects binary elliptic curves, which are
    rarely used in real-world applications. Credit to XlabAI Team of Tencent
    Xuanwu Lab and Atuin Automated Vulnerability Discovery Engine for reporting
    the issue. CVE-2026-26007
  * Support for SECT* binary elliptic curves is deprecated and will be removed
    in the next release.
- Update to 46.0.4
  * Dropped support for win_arm64 wheels.
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.5.
- Update to 46.0.3
  * Fixed compilation when using LibreSSL 4.2.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1774612800">- update to 46.0.6 (CVE-2026-34073, bsc#1260876):
  * SECURITY ISSUE: Fixed a bug where name constraints were not
    applied to peer names during verification when the leaf
    certificate contains a wildcard DNS SAN. Ordinary X.509
    topologies are not affected by this bug, including those used
    by the Web PKI. Credit to Oleh Konko (1seal) for reporting
    the issue. CVE-2026-34073</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1774958400">- Add patch support-maturin-1.12.patch:
  * Correctly deal with maturin bugfix that installs tests and
    docs under sitearch.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1775822400">- Update to 46.0.7 (fixes CVE-2026-39892, bsc#1261863)
  * **SECURITY ISSUE**: Fixed an issue where non-contiguous buffers could be
    passed to APIs that accept Python buffers, which could lead to buffer
    overflow. **CVE-2026-39892**
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.6.
- drop support-maturin-1.12.patch (upstream)
- drop no-pytest_benchmark.patch,
  Make-unsafe-subinterpreter-support-available-via-cfg.patch:
  obsolete</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1777204800">- update to 47.0.0:
  * Support for Python 3.8 is deprecated and will be removed in
    the next cryptography release.
  * BACKWARDS INCOMPATIBLE: Support for binary elliptic curves
    (SECT* classes) has been removed. These curves are rarely
    used and have additional security considerations that make
    them undesirable.
  * BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.1.x has been
    removed. OpenSSL 3.0.0 or later is now required. LibreSSL,
    BoringSSL, and AWS-LC continue to be supported.
  * BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL &lt; 4.1.
  * BACKWARDS INCOMPATIBLE: Loading keys with unsupported
    algorithms or keys with unsupported explicit curve encodings
    now raises
    :class:`~cryptography.exceptions.UnsupportedAlgorithm`
    instead of ValueError. This change affects :func:`~cryptograp
    hy.hazmat.primitives.serialization.load_pem_private_key`, :fu
    nc:`~cryptography.hazmat.primitives.serialization.load_der_pr
    ivate_key`, :func:`~cryptography.hazmat.primitives.serializat
    ion.load_pem_public_key`, :func:`~cryptography.hazmat.primiti
    ves.serialization.load_der_public_key`, and
    :meth:`~cryptography.x509.Certificate.public_key` when called
    on certificates with unsupported public key algorithms.
  * BACKWARDS INCOMPATIBLE: When parsing elliptic curve private
    keys, we now reject keys that incorrectly encode a private
    key of the wrong length because such keys are impossible to
    process in a constant-time manner. We do not believe keys
    with this problem are in wide use, however we may revert this
    change based on the feedback we receive.
  * Deprecated passing 64-bit (8-byte) and 128-bit (16-byte) keys
    to :class:`~cryptography.hazmat.decrepit.ciphers.algorithms.T
    ripleDES`. In a future release, only 192-bit (24-byte) keys
    will be accepted. Users should expand shorter keys themselves
    (e.g., for single DES: key + key + key, for two-key: key +
    key[:8]).
  * Updated the minimum supported Rust version (MSRV) to 1.83.0,
    from 1.74.0.
  * Support for x86_64 macOS (including publishing wheels) is
    deprecated and will be removed in the next release. We will
    switch to publishing an arm64 only wheel for macOS.
  * Support for 32-bit Windows (including publishing wheels) is
    deprecated and will be removed in the next release. Users
    should move to a 64-bit Python installation.
  * public_bytes and private_bytes methods on keys now raise
    TypeError (instead of ValueError) if an invalid encoding is
    provided for the given format.
  * Moved
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.CFB`,
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.OFB`, and
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.CFB8`
    into :doc:`/hazmat/decrepit/index` and deprecated them in the
    modes module. They will be removed from the modes module in
    49.0.0.
  * Moved :class:`~cryptography.hazmat.primitives.ciphers.algorit
    hms.Camellia` into  :doc:`/hazmat/decrepit/index` and
    deprecated it in the cipher module. It will be removed from
    the cipher module in 49.0.0.
  * Added
    :meth:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF.extract`
    to :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF`.
    The previous private implementation will be removed in
    49.0.0.
  * Added support for loading elliptic curve keys that contain
    explicit encodings of the curves secp256r1, secp384r1, and
    secp521r1.
  * Added support for
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2d`
    and
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2i`
    when using OpenSSL 3.2.0+.
  * Added derive_into methods to
    :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF`,
    :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDFExpand`,
    :class:`~cryptography.hazmat.primitives.kdf.concatkdf.ConcatK
    DFHash`, :class:`~cryptography.hazmat.primitives.kdf.concatkd
    f.ConcatKDFHMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2id`,
    :class:`~cryptography.hazmat.primitives.kdf.pbkdf2.PBKDF2HMAC
    `,
    :class:`~cryptography.hazmat.primitives.kdf.kbkdf.KBKDFHMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.kbkdf.KBKDFCMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.scrypt.Scrypt`,
    and
    :class:`~cryptography.hazmat.primitives.kdf.x963kdf.X963KDF`
    to allow deriving keys directly into pre-allocated buffers.
  * Added encrypt_into and decrypt_into methods to
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESCCM`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESGCM`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESGCMSI
    V`, :class:`~cryptography.hazmat.primitives.ciphers.aead.AESO
    CB3`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESSIV`,
    and :class:`~cryptography.hazmat.primitives.ciphers.aead.ChaC
    ha20Poly1305` to allow encrypting directly into a pre-
    allocated buffer.
  * Added support for PKCS1v15 signing without DigestInfo using :
    class:`~cryptography.hazmat.primitives.asymmetric.utils.NoDig
    estInfo`.
  * Added
    :meth:`~cryptography.hazmat.primitives.hashes.Hash.hash`, a
    one-shot method for computing hashes.
  * Added :doc:`/hazmat/primitives/hpke` support implementing RFC
    9180 for hybrid authenticated encryption.
  * Added new :doc:`/hazmat/primitives/asymmetric/mlkem` module
    with support for ML-KEM key encapsulation with AWS-LC and
    BoringSSL. Note: Post-quantum algorithm support requires AWS-
    LC or BoringSSL. As we ship our wheels with OpenSSL, most
    users will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Note: Post-quantum algorithm support requires AWS-LC or
    BoringSSL. As we ship our wheels with OpenSSL, most users
    will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Added new :doc:`/hazmat/primitives/asymmetric/mldsa` module
    with support for ML-DSA signing and verification with AWS-LC
    and BoringSSL. Note: Post-quantum algorithm support requires
    AWS-LC or BoringSSL. As we ship our wheels with OpenSSL, most
    users will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Note: Post-quantum algorithm support requires AWS-LC or
    BoringSSL. As we ship our wheels with OpenSSL, most users
    will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Added new :doc:`/hazmat/asn1/index` module with support for
    declaratively defining custom ASN.1 types and
    encoding/decoding them.
  * Fixed compilation when using LibreSSL 4.3.0 and OpenSSL
    4.0.0.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 4.0.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1778414400">- update to 48.0.0:
  * BACKWARDS INCOMPATIBLE: Support for Python 3.8 has been
    removed. cryptography now requires Python 3.9 or later.
  * BACKWARDS INCOMPATIBLE: Loading an X.509 CRL whose inner
    TBSCertList.signature algorithm does not match the outer
    signatureAlgorithm now raises ValueError. Previously, such
    CRLs were parsed successfully and only rejected during
    signature validation.
  * Added support for :doc:`/hazmat/primitives/asymmetric/mlkem`
    and :doc:`/hazmat/primitives/asymmetric/mldsa` when using
    OpenSSL 3.5.0 or later, in addition to the existing AWS-LC
    and BoringSSL support. This means post-quantum algorithms are
    now available to users of our wheels. Note: Going forward, we
    do not guarantee that all functionality in cryptography will
    be available when building against OpenSSL. See
    :doc:`/statements/state-of-openssl` for more information.
  * Note: Going forward, we do not guarantee that all
    functionality in cryptography will be available when building
    against OpenSSL. See :doc:`/statements/state-of-openssl` for
    more information.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1781438400">- update to 49.0.0:
  * BACKWARDS INCOMPATIBLE: Removed the deprecated
    PUBLIC_KEY_TYPES, PRIVATE_KEY_TYPES,
    CERTIFICATE_PRIVATE_KEY_TYPES,
    CERTIFICATE_ISSUER_PUBLIC_KEY_TYPES, and
    CERTIFICATE_PUBLIC_KEY_TYPES type aliases. Use
    PublicKeyTypes, PrivateKeyTypes,
    CertificateIssuerPrivateKeyTypes,
    CertificateIssuerPublicKeyTypes, and
    CertificatePublicKeyTypes instead. These were deprecated in
    version 40.0.
  * BACKWARDS INCOMPATIBLE: :class:`~cryptography.hazmat.primitiv
    es.ciphers.algorithms.ChaCha20` now treats the first 4 bytes
    of the nonce as a 32-bit little-endian block counter (as
    defined in RFC 7539) and tracks the number of bytes
    processed. Attempting to encrypt or decrypt more data than
    the counter allows before it would overflow now raises a
    :class:`ValueError` rather than silently diverging from RFC
    7539. Setting the counter portion of the nonce to zero allows
    encrypting up to 256 GiB with a given nonce.
  * BACKWARDS INCOMPATIBLE: Loading an X.509 certificate whose
    ECDSA or DSA signature AlgorithmIdentifier contains encoded
    NULL parameters now raises a :class:`ValueError`. Such
    certificates are invalid, but older versions of Java emitted
    them; previously they loaded with a deprecation warning.
  * Fixed cross-compilation of the CFFI bindings when
    PYO3_CROSS_LIB_DIR is set. The build now derives the Python
    include directory from PYO3_CROSS_LIB_DIR instead of querying
    the host interpreter, which previously caused the build to
    fail during cross-compilations for embedded systems, on hosts
    which have same-version Python development headers installed
    as the target Python.
  * Added support for signing and verifying X.509 certificates,
    certificate signing requests, and certificate revocation
    lists with :doc:`/hazmat/primitives/asymmetric/mldsa` keys,
    as well as loading certificates that contain ML-DSA public
    keys.
  * Added
    :meth:`~cryptography.hazmat.primitives.hpke.KEM.enc_length`
    to :class:`~cryptography.hazmat.primitives.hpke.KEM` so
    callers can split the encapsulated key from the ciphertext
    returned by
    :meth:`~cryptography.hazmat.primitives.hpke.Suite.encrypt`.
  * :meth:`~cryptography.x509.verification.ExtensionPolicy.requir
    e_present`, :meth:`~cryptography.x509.verification.ExtensionP
    olicy.may_be_present`, and :meth:`~cryptography.x509.verifica
    tion.ExtensionPolicy.require_not_present` now accept any
    extension type. Previously only a fixed set of extension
    types was supported, which made it impossible to account for
    otherwise unrecognized critical extensions during path
    validation.
  * Added support for using
    :class:`~cryptography.x509.Certificate`,
    :class:`~cryptography.x509.CertificateSigningRequest`, and
    :class:`~cryptography.x509.CertificateRevocationList` as
    field types in :doc:`/hazmat/asn1/index` structures.
  * Added :func:`~cryptography.hazmat.asn1.value_set`, a class
    decorator that registers an :class:`enum.Enum` subclass as an
    ASN.1 value set: members are encoded as their underlying
    value, and decoding fails if the decoded value does not match
    one of the declared members.
  * Added :meth:`~cryptography.x509.Name.from_bytes` for parsing
    a :class:`~cryptography.x509.Name` from DER bytes, the
    inverse of :meth:`~cryptography.x509.Name.public_bytes`.
  * Added the rsa_padding keyword-only parameter to
    :meth:`~cryptography.x509.CertificateBuilder.public_key`.
    Passing the :class:`~cryptography.hazmat.primitives.asymmetri
    c.padding.PSS` class (not an instance) encodes an RSA subject
    public key in the certificate's subjectPublicKeyInfo with the
    id-RSASSA-PSS OID and no parameters.
  * Added external mu (message representative) support to
    :doc:`/hazmat/primitives/asymmetric/mldsa` via the sign_mu
    and verify_mu methods, which sign and verify a precomputed
    64-byte mu as defined in FIPS 204.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 4.0.1.</changelog>
</package>
<package pkgid="21e4efcabf698d06edfd937d541bbc55fd8d325919f6af29127d462c93a8992bc72c719be2bb22c08a146e51c4b17fa9834c36e889c157d9f2badb03f2fb6374" name="python311-libnacl" arch="noarch">
  <version epoch="0" ver="2.1.0" rel="63.13"/>
  <changelog author="tchvatal@suse.com" date="1533902400">- Fix the libsodium dependency on the runtime to be copied by macros
- Install license file</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1571054400">- Replace %fdupes -s with plain %fdupes; hardlinks are better.</changelog>
  <changelog author="Ond&#x159;ej S&#xFA;kup &lt;mimi.vx@gmail.com&gt;" date="1583236800">- update to 1.7.1
  * Bindings for kdf in libsodium
  * Added extra key validation
  * Add Crypto_box_easy</changelog>
  <changelog author="Niels Abspoel &lt;aboe76@gmail.com&gt;" date="1612180800">- Update to 1.7.2
  * remove encoding parameter json.loads for python 3.9 compatibility
  * implement functions for equal-comparison and hashing keys
  * improved spec file</changelog>
  <changelog author="Niels Abspoel &lt;aboe76@gmail.com&gt;" date="1613649600">- Revert libsodium requirement back to libsodium23</changelog>
  <changelog author="Niels Abspoel &lt;aboe76@gmail.com&gt;" date="1623412800">- add crypto_kdf_derive.patch to fix crypto_kdf_derive_from_key() on 32-bit platforms</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1688558400">- Add %{?sle15_python_module_pythons}</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1709294400">- Update to 2.1.0:
  * Added classes to the libnacl.aead module allowing for the use of
    XChaCha20-Poly1305-IETF, ChaCha20-Poly1305-IETF, and AES256-GCM.
  * Added the libnacl.kx module. This module contains the ExchangeKey class.
- Switch to autosetup and pyproject macros.
- Drop patch crypto_kdf_derive.patch, no longer required.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1718193600">- update to libsodium26</changelog>
  <changelog author="Max Lin &lt;mlin@suse.com&gt;" date="1755864000">- Use BuildRequires: poetry-core to instead of BuildRequires: poetry</changelog>
</package>
<package pkgid="971272a2376e6d36f956ddbcc4484fe79f9f915fa63b71cb687116e0facaf2ef674ca2d2270a175eda9620470755f8da64ce29ca0e60e4677b21f6aacbb07e90" name="python311-logutils" arch="noarch">
  <version epoch="0" ver="0.3.5" rel="30.30"/>
  <changelog author="speilicke@suse.com" date="1374148800">- Initial version</changelog>
  <changelog author="tbechtold@suse.com" date="1498737600">- update to 0.3.5:
  - Bring QueueListener implementation in line with the version in the stdlib.
  - Fixed a bug in ColorizingStreamHandler relating to encoding.
  - Return non-zero error code from "setup.py test" when a test fails.
  - Make the dictConfig tests work with both Python 2.x and 3.x.
- convert to singlespec
- fix Source url
- split -doc package
- update Url</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1543924800">- Remove superfluous devel dependency for noarch package</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1622894400">- add sphinx4.patch to enable build with Sphinx 4.x</changelog>
  <changelog author="pgajdos@suse.com" date="1630497600">- %check: use %pyunittest rpm macro</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1676635200">- update path for SLE15</changelog>
  <changelog author="Ben Greiner &lt;code@bnavigator.de&gt;" date="1705579200">- Add logutils-pr1-fix-testasserts-py3.12.patch
  * https://bitbucket.org/vinay.sajip/logutils/pull-requests/1
  * Fixes the test suite. This package is really old but still
    half-maintained
- Switch to PEP517
- Deduplicate files</changelog>
  <changelog author="Christoph G &lt;foss@grueninger.de&gt;" date="1725537600">- Add patch logutils-intersphinx.patch to fix compatibility
  with recent Sphinx</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1725969600">- Add patch use-logging-lock-directly.patch:
  * Use logging._lock as a context manager.
- Switch to autosetup macro.</changelog>
</package>
<package pkgid="33074ca0d510287227194ec8c2bac46688f45d733573f2ddbc11c68a9f2ba54bb66a59303c385ebc44e50d83de8a2cddedd77339a8f79540d7b83e3da149630b" name="python311-pecan" arch="noarch">
  <version epoch="0" ver="1.4.2" rel="79.2"/>
  <changelog author="Tom&#xE1;&#x161; Chv&#xE1;tal &lt;tchvatal@suse.com&gt;" date="1584187200">- Fix build without python2</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1620216000">- version update to 1.4.0
  * pecan now requires webob &gt;= 1.8
  * fixed a bug when parsing certain Accept headers
    (https://github.com/Pylons/webob/issues/403)
  * removed official support for Python 3.5
- Rebase patch:
  * pecan-no-kajiki.patch
- Add patches to support SQLAlchemy 1.4.x (gh#pecan/pecan#125)
  * 0001-Support-SQLAlchemy-1.4.x.patch
  * 0002-Fix-typo-from-bad-copy-paste.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1622116800">- %check: use %pyunittest macro</changelog>
  <changelog author="Stefan Schubert &lt;schubi@suse.de&gt;" date="1633089600">- Use libalternatives instead of update-alternatives.</changelog>
  <changelog author="Stefan Schubert &lt;schubi@suse.de&gt;" date="1633435200">- Added BuildRequires:  alts</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1639224000">- update to 1.4.1:
  * add support for Python 3.10
  * added trove classifiers for Python 3.6 - 3.9
  * fixed a bug related to setuptools as a dependency
  * fixed a bug that broke pecan when used with certain
  versions of SQLAlchemy
- drop 0001-Support-SQLAlchemy-1.4.x.patch,
  0002-Fix-typo-from-bad-copy-paste.patch: obsolete (upstream)</changelog>
  <changelog author="pgajdos@suse.com" date="1649246400">- python-mock is not required for build</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1658232000">- update to 1.4.2:
  * pecan no longer depends on webtest</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1674907200">- restore webtest dependency, needed by pecan.testing</changelog>
  <changelog author="Mark&#xE9;ta Machov&#xE1; &lt;mmachova@suse.com&gt;" date="1684756800">- add sqlalchemy2.patch to support SQLAlchemy 2.0</changelog>
</package>
<package pkgid="7a79b7d90144e19f99b7130e074600f09e6511624a27b8e65d2f23f2e6bfe85cc793e5a6eaca309ae204eef685f965e38d55ef8f79cbf735132ba03ad383edca" name="python312-pecan" arch="noarch">
  <version epoch="0" ver="1.4.2" rel="79.2"/>
  <changelog author="Tom&#xE1;&#x161; Chv&#xE1;tal &lt;tchvatal@suse.com&gt;" date="1584187200">- Fix build without python2</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1620216000">- version update to 1.4.0
  * pecan now requires webob &gt;= 1.8
  * fixed a bug when parsing certain Accept headers
    (https://github.com/Pylons/webob/issues/403)
  * removed official support for Python 3.5
- Rebase patch:
  * pecan-no-kajiki.patch
- Add patches to support SQLAlchemy 1.4.x (gh#pecan/pecan#125)
  * 0001-Support-SQLAlchemy-1.4.x.patch
  * 0002-Fix-typo-from-bad-copy-paste.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1622116800">- %check: use %pyunittest macro</changelog>
  <changelog author="Stefan Schubert &lt;schubi@suse.de&gt;" date="1633089600">- Use libalternatives instead of update-alternatives.</changelog>
  <changelog author="Stefan Schubert &lt;schubi@suse.de&gt;" date="1633435200">- Added BuildRequires:  alts</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1639224000">- update to 1.4.1:
  * add support for Python 3.10
  * added trove classifiers for Python 3.6 - 3.9
  * fixed a bug related to setuptools as a dependency
  * fixed a bug that broke pecan when used with certain
  versions of SQLAlchemy
- drop 0001-Support-SQLAlchemy-1.4.x.patch,
  0002-Fix-typo-from-bad-copy-paste.patch: obsolete (upstream)</changelog>
  <changelog author="pgajdos@suse.com" date="1649246400">- python-mock is not required for build</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1658232000">- update to 1.4.2:
  * pecan no longer depends on webtest</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1674907200">- restore webtest dependency, needed by pecan.testing</changelog>
  <changelog author="Mark&#xE9;ta Machov&#xE1; &lt;mmachova@suse.com&gt;" date="1684756800">- add sqlalchemy2.patch to support SQLAlchemy 2.0</changelog>
</package>
<package pkgid="47a3777ba7fb8f04413e9c959f1112e40206aba604085a95a88dfab9af71d81968346e05c36ba29dd64cd1c4293c74872b9543c63c289429629b3b48fa35f3fd" name="python313-Routes" arch="noarch">
  <version epoch="0" ver="2.5.1" rel="56.7"/>
  <changelog author="tbechtold@suse.com" date="1464955200">- update to 2.3.1:
  * Backwards compatability fix - connect should work with mandatory
    routename and optional path. Patch by Davanum Srinivas (PR #65).
  * Fix sub_domain equivalence check. Patch by Nikita Uvarov
  * Add support for protocol-relative URLs generation (i.e. starting with double
    slash ``//``). PR #60. Patch by Sviatoslav Sydorenko.
  * Add support for the ``middleware`` extra requirement, making possible to
    depend on ``webob`` optionally. PR #59. Patch by Sviatoslav Sydorenko.
  * Fix matching of an empty string route, which led to exception in earlier
    versions. PR #58. Patch by Sviatoslav Sydorenko.
  * Add support for the ``requirements`` option when using
    mapper.resource to create routes. PR #57. Patch by Sean Dague.
  * Concatenation fix when using submappers with path prefixes. Multiple
    submappers combined the path prefix inside the controller argument in
    non-obvious ways. The controller argument will now be properly carried
    through when using submappers. PR #28.</changelog>
  <changelog author="tbechtold@suse.com" date="1498737600">- update to 2.4.1:
  * Release as a universal wheel. PR #75.
  * Convert readthedocs links for their .org -&gt; .io migration for hosted projects.
- convert to singlespec
- Fix Source url</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1543924800">- Remove superfluous devel dependency for noarch package</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1573128000">- Run through spec-cleaner</changelog>
  <changelog author="pgajdos@suse.com" date="1592395200">- nose -&gt; pytest</changelog>
  <changelog author="Dirk Mueller &lt;dmueller@suse.com&gt;" date="1606392000">- update to 2.5.1:
  * Add compatibility for Python 3.7+.
  * Add graceful fallback for invalid character encoding from request object.
  * Enhanced performance for matching routes that share the same static prefix.
  * Fixed issue with child routes not passing route conditions to the Mapper.connect call.
  * Fixed documentation to reflect default value for minimization.
  * Allow backslash to escape special characters in route paths.
  * Resolve invalid escape sequences.
  * Remove support for Python 2.6, 3.3, and 3.4.
  * Remove obsolete Python 2.3 compat code.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1636372800">- add six dependency declaration</changelog>
  <changelog author="Ben Greiner &lt;code@bnavigator.de&gt;" date="1660824000">- Clean specfile, remove coverage</changelog>
  <changelog author="Mark&#xE9;ta Machov&#xE1; &lt;mmachova@suse.com&gt;" date="1717761600">- Add remove-six.patch to get rid of six</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1750766400">- Switch to pyproject macros.</changelog>
</package>
<package pkgid="fcc85441ef71a274c2447da1456f76244c479407cf13b488b0f48f71be0f481052a16f15c4f8c27ecc7ac268ef76e658712df33f9021900325af757e7f78aaf3" name="python313-asyncssh" arch="noarch">
  <version epoch="0" ver="2.23.1" rel="75.1"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1672920000">- update to 2.13.0:
  * Updated testing and coverage to drop Python 3.6 and add Python 3.11.
  * Added new "recv_eof" option to not pass an EOF from a channel to a
    redirected target, allowing output from multiple SSH sessions to be
    sent and mixed with other direct output to that target.
  * Added new methods to make it easy to perform forwarding between TCP
    ports and UNIX domain sockets.
  * Added a workaround for a problem seen on a Huawei SFTP server where
    it sends an invalid combination of file attribute flags.
  * Fixed an issue with copying files to SFTP servers that don't support
    random access I/O.
  * Fixed an issue when requesting remote port forwarding on a dynamically
    allocated port.
  * Fixed an issue where readexactly could block indefinitely when a signal
    is delivered in the stream before the requested number of bytes are
    available.
  * Fixed an interoperability issue with OpenSSH when using SSH certificates
    with RSA keys with a SHA-2 signature.
  * Fixed an issue with handling "None" in ProxyCommand, GlobalKnownHostsFile,
    and UserKnownHostsFile config file options.</changelog>
  <changelog author="Daniel Garcia &lt;daniel.garcia@suse.com&gt;" date="1674648000">- Add remove-sha1.patch to make it compatible with latests versions of
  cryptography gh#ronf/asyncssh@fae5a9e8baad</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1678104000">- update to 2.13.1:
  * Updated type definitions for mypy 1.0.0, removing a
    dependency on implicit Optional types, and working around an
    issue that could trigger a mypy internal error.
  * Updated unit tests to avoid calculation of SHA-1 signatures,
    which are no longer allowed in cryptography 39.0.0.
- drop remove-sha1.patch (upstream)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1688212800">- update to 2.13.2:
  * Fixed an issue with host-based authentication when using
    proxy_command, allowing it to be used if the caller
    explicitly specifies client_host.
  * Improved handling of signature algorithms for OpenSSH
    certificates so that RSA SHA-2 signatures will work with
    both older and newer versions of OpenSSH.
  * Worked around an issue with some Cisco SSH implementations
    generating invalid "ignore" packets.
  * Fixed unit tests to avoid errors when cryptography's version
    of * OpenSSL disables support for SHA-1 signatures.
  * Fixed unit tests to avoid errors when the filesystem enforces
    that filenames be valid UTF-8 strings.
  * Added documentation about which config options apply when
    passing a string as a tunnel argument.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1696507200">- update to 2.14.0:
  * Added support for a new accept_handler argument when setting
    up local port forwarding, allowing the client host and port to
    be validated and/or logged for each new forwarded connection.
  * Added an option to disable expensive RSA private key checks
    when using OpenSSL 3.x. Functions that read private keys have
    been modified to include a new unsafe_skip_rsa_key_validation
    argument which can be used to avoid these additional checks,
    if you are loading keys from a trusted source.
  * Added host information into AsyncSSH exceptions when host key
    validation fails, and a few other improvements related to
    X.509 certificate validation errors.
  * Fixed a regression which prevented keys loaded into an SSH
    agent with a certificate from working correctly beginning in
    AsyncSSH after version 2.5.0.
  * Fixed an issue which was triggering an internal exception
    when shutting down server sessions with the line editor enabled
    which could cause some output to be lost on exit, especially when
    running on Windows.
  * Fixed a documentation error in SSHClientConnectionOptions and
    SSHServerConnectionOptions.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1699617600">- update to 2.14.1 (bsc#1217028, CVE-2023-46445):
  * Hardened AsyncSSH state machine against potential message
    injection attacks, described in more detail in
    `CVE-2023-46445 and CVE-2023-46446
  * Added support for passing in a regex in readuntil in
    SSHReader,
  * Added support for get_addresses() and get_port() methods on
  * SSHAcceptor.
  * Fixed an issue with AsyncFileWriter potentially writing data
  * out of order.
  * Updated testing to include Python 3.12.
  * Updated readthedocs integration to use YAML config file.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1702900800">- update to 2.14.2 (bsc#1218165, CVE-2023-48795):
  * Implemented "strict kex" support and other countermeasures to
  * protect against the Terrapin Attack described in
    CVE-2023-48795
  * Fixed config parser to properly an optional equals delimiter
    in all config arguments.
  * Fixed TCP send error handling to avoid race condition when
    receiving incoming disconnect message.
  * Improved type signature in SSHConnection async context
    manager.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1723204800">- update to 2.15.0:
  * Added experimental support for tunneling of TUN/TAP network
    interfaces on Linux and macOS, allowing for either automatic
    packet forwarding or explicit reading and writing of packets
    sent through the tunnel by the application. Both callback and
    stream APIs are available.
  * Added support for forwarding terminal size and terminal size
    changes when stdin on an SSHServerProcess is redirected to a
    local TTY.
  * Added support for multiple tunnel/ProxyJump hosts. Thanks go
    to Adam Martin for suggesting this enhancement and proposing
    a solution.
  * Added support for OpenSSH lsetstat SFTP extension to set
    attributes on symbolic links on platforms which support that
    and use it to improve symlink handling in the SFTP get, put,
    and copy methods. In addition, a follow_symlinks option has
    been added on various SFTPClient methods which get and set
    these attributes. Thanks go to GitHub user eyalgolan1337 for
    reporting this issue.
  * Added support for password and passphrase arguments to be a
    callable or awaitable, called when performing authentication
    or loading encrypted private keys. Thanks go to GitHub user
    goblin for suggesting this enhancement.
  * Added support for proper flow control when using
    AsyncFileWriter or StreamWriter classes to do SSH process
    redirection. Thanks go to Benjy Wiener for reporting this
    issue and providing feedback on the fix.
  * Added is_closed() method
    SSHClientConnection/SSHServerConnection to return whether the
    associated network connection is closed or not.
  * Added support for setting and matching tags in OpenSSH config
    files.
  * Added an example of using "await" in addition to "async with"
    when opening a new SSHClientConnection. Thanks go to Michael
    Davis for suggesting this added documentation.
  * Improved handling CancelledError in SCP, avoiding an issue
    where AsyncSSH could sometimes get stuck waiting for the
    channel to close. Thanks go to Max Orlov for reporting the
    problem and providing code to reproduce it.
  * Fixed a regression from 2.14.1 related to rekeying an SSH
    connection when there's acitivty on the connection in the
    middle of rekeying. Thanks go to GitHub user eyalgolan1337
    for helping to narrow down this problem and test the fix.
  * Fixed a problem with process redirection when a close is
    received without a preceding EOF. Thanks go to GitHub user
    xuoguoto who helped to provide sample scripts and ran tests
    to help track this down.
  * Fixed the processing of paths in SFTP client symlink
    requests. Thanks go to André Glüpker for reporting the
    problem and providing test code to demonstrate it.
  * Fixed an OpenSSH config file parsing issue. Thanks go to
    Siddh Raman Pant for reporting this issue.
  * Worked around a bug in a user auth banner generated by the
    cryptlib library. Thanks go to GitHub user mmayomoar for
    reporting this issue and suggesting a fix.</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1727352000">- update to 2.17.0:
  * Add support for specifying a per-connection credential store
    for GSSAPI authentication.
  * Fixed a regression introduced in AsyncSSH 2.15.0 which could
    cause connections to be closed with an uncaught exception when
    a session on the connection was closed.
  * Added a workaround where getaddrinfo() on some systems may
    return duplicate entries, causing bind() to fail when opening
    a listener.
  * Relaxed padding length check on OpenSSH private keys to
    provide better compatibility with keys generated by PuTTYgen.
  * Improved documentation on SSHClient and SSHServer classes to
    explain when they are created and their relationship to the
    SSHClientConnection and SSHServerConnection classes.
  * Updated examples to use Python 3.7 and made some minor
    improvements.
- update to 2.16.0:
  * Added client and server support for the OpenSSH "hostkeys"
    extension. When using known_hosts, clients can provide a
    handler which will be called with the changes between the
    keys currently trusted in the client's known hosts and those
    available on the server. On the server side, an application
    can choose whether or not to enable the sending of this host
    key information.
  * Related to the above, AsyncSSH now allows the configuration of
    multiple server host keys of the same type when the
    send_server_host_keys option is enabled. Only the first key of
    each type will be used in the SSH handshake, but the others can
    appear in the list of supported host keys for clients to begin
    trusting, allowing for smoother key rotation.
  * Fixed logging and typing issues in SFTP high-level copy
    functions. A mix of bytes, str, and PurePath entries are now
    supported in places where a list of file paths is allowed, and
    the type signatures have been updated to reflect that the
    functions accept either a single path or a list of paths.
  * Improved typing on SFTP listdir() function.
  * Reworked the config file parser to improve on a previous fix
    related to handling key/value pairs with an equals delimiter.
  * Improved handling of ciphers deprecated in cryptography 43.0.0.
  * Improved support for use of Windows pathnames in ProxyCommand.</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1730980800">- Update to 2.18.0
  * Added support for post-quantum ML-KEM key exchange algorithms,
    interoperable with OpenSSH 9.9.
  * Added support for the OpenSSH "limits" extension, allowing the
    client to query server limits such as the maximum supported read
    and write sizes. The client will automatically default to the reported
    maximum size on servers that support this extension.
  * Added more ways to specify environment variables via the `env` option.
    Sequences of either 'key=value' strings or (key, value) tuples are now
    supported, in addition to a dict.
  * Added support for getting/setting environment variables as byte strings
    on platforms which support it. Previously, only Unicode strings were
    accepted and they were always encoded on the wire using UTF-8.
  * Added support for non-TCP sockets (such as a socketpair) as the `sock`
    parameter in connect calls. Thanks go to Christian Wendt for reporting
    this problem and proposing a fix.
  * Changed compression to be disabled by default to avoid it becoming a
    performance bottleneck on high-bandwidth connections. This now also
    matches the OpenSSH default.
  * Improved speed of parallelized SFTP reads when read-ahead goes beyond
    the end of the file. Thanks go to Maximilian Knespel for reporting
    this issue and providing performance measurements on the code before
    and after the change.
  * Improved cancellation handling during SCP transfers.
  * Improved support for selecting the currently available security key
    when the application lists multiple keys to try. Thanks go to GitHub
    user zanda8893 for reporting the issue and helping to work out the
    details of the problem.
  * Improved handling of reverse DNS failures in host-based authentication.
    Thanks go to GitHub user xBiggs for suggesting this change.
  * Improved debug logging of byte strings with non-printable characters.
  * Switched to using an executor on GSSAPI calls to avoid blocking the
    event loop.
  * Fixed handling of "UserKnownHostsFile none" in config files. This
    previously caused it to use the default known hosts, rather than
    disabling known host checking.
  * Fixed a runtime warning about not awaiting a coroutine in unit tests.
  * Fixed a unit test failure on Windows when calling abort on a transport.
  * Fixed a problem where a "MAC verification failed" error was sometimes
    sent on connection close.
  * Fixed SSHClientProcess code to not raise a runtime exception when
    waiting more than once for a process to finish. Thanks go to GitHub
    user starflows for reporting this issue.
  * Handled an error when attempting to import older verions of pyOpenSSL.
    Thanks go to Maximilian Knespel for reporting this issue and testing
    the fix.
  * Updated simple_server example code to switch from crypt to bcrypt,
    since crypt has been removed in Python 3.13. Thanks go to Colin
    Watson for providing this update.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1749816000">- Switch to pyproject macros.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1752321600">- update to 2.21.0:
  * Added sparse file support for SFTP, allowing file copying
    which automatically skips over any "holes" in a source file,
    transferring only the data ranges which are actually present.
  * Added support for applications to request that session,
    connection, or TUN/TAP requests arriving on an
    SSHServerConnection be forwarded out some other established
    SSHClientConnection. Callback methods on SSHServer which
    decide how to handle these requests can now return an
    SSHClientConnection to set up this tunneling, instead of
    having to accept the request and implement their own
    forwarding logic.
  * Further hardened the SSH key exchange process to make
    AsyncSSH more strict when accepting messages during key
    exchange. Thanks go to Fabian Bäumer and Marcus Brinkmann for
    identifying potential issues here.
  * Added support for the auth_completed callback in SSHServer to
    be either a callable or a coroutine, allowing async
    operations to be performed when user authentication completes
    successfully, prior to accepting session requests.
  * Added support for the sftp_factory config argument be either
    a callable or a coroutine, allowing async operations to be
    performed when starting up a new SFTP server session.
  * Fixed a bug where the exit() method of SFTPServer didn't
    handle being declared as a coroutine. Thanks go to C. R.
    Oldham for reporting this issue.
  * Improved handling of exceptions in connection_lost()
    callbacks. Exceptions in connection_lost() will now be
    reported in the debug log, but other cleanup code in AsyncSSH
    will continue, ignoring those exceptions. Thanks go to Danil
    Slinchuk for reporting this issue.
  * Added support for specifying an explicit path when
    configuring agent forwarding. Thanks go to Aleksandr Ilin for
    pointing out that this options supports more than just a
    boolean value.
  * Added support for environment variable expansion in SSH
    config, for options which support percent expansion.
  * Added a new begin_auth callback in SSHClient, reporting the
    username being sent during SSH client authentication. This
    can be useful when the user is conditionally set via an SSH
    config file.
  * Improved strict-kex interoperability during re-keying. Thanks
    go to GitHub user emeryalden for reporting this issue and
    helping to track down the source of the problem.
  * Updated SFTP max_requests default to reduce memory usage when
    using large block sizes.
  * Updated testing to add Python 3.13 and drop Python 3.7,
    avoiding deprecation warnings from the cryptography package.
  * Fixed unit test issues under Windows, allowing unit tests to
    run on Windows on all supported versions of Python.
  * Fixed a couple of issues with Python 3.14. Thanks go to Georg
    Sauthoff for initially reporting this.
  * Added support for WebAuthN authentication with U2F security
    keys, allowing non-admin Windows users to use these keys for
    authentication. Previously, authentication with U2F keys
    worked on Windows, but only for admin users.
  * Added support for hostname canonicalization, compatible with
    the configuration parameters used in OpenSSH, as well as
    support for the "canonical" and "final" match keywords and
    negation support for match. Thanks go to GitHub user
    commonism who suggested this and provided a proposed
    implementation for negation.
  * Added client and server support for SFTP copy-data extension
    and a new SFTP remote_copy() function which allows data to be
    moved between two remote files without downloading and re-
    uploading the data. Thanks go to Ali Khosravi for suggesting
    this addition.
  * Moved project metadata from setup.py to pyproject.toml.
    Thanks go to Marc Mueller for contributing this.
  * Updated SSH connection to keep strong references to
    outstanding tasks, to avoid potential issues with the garbage
    collector while the connection is active. Thanks go to GitHub
    user Birnendampf for pointing out this potential issue and
    suggesting a simple fix.
  * Fixed some issues with block_size argument in SFTP copy
    functions. Thanks go to Krzysztof Kotlenga for finding and
    reporting these issues.
  * Fixed an import error when fido2 package wasn't available.
    Thanks go to GitHub user commonism for reporting this issue.</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1760011200">- Update to 2.21.1
  * Added the capability to defer invoking passphrase callback until
    an encrypted private key is actually used in a signing operation,
    rather than triggering the callback when keys are loaded. This
    will only work when a public key is provided with an encrypted
    private key either explicitly or as part of the key format (such
    as in OpenSSH's private key format).
  * Improved handling of KeyboardInterrupt and task cancellation in
    SCP. Thanks go to Viktor Kertesz for reporting this issue and
    helping to understand the behavior in various versions of Python.
  * Fixed the env option to support mappings other than dict. Thanks
    go to Boris Pavlovic for reporting this issue.
  * Fixed a potential race condition in SSHForwarder cleanup. Thanks
    go to GitHub user misa-hase for reporting this issue and helping
    to test the fix.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1760097600">- Add fido2-compat.patch to restore compatibility with python-fido2 &gt;= 2
- Update requirements from pyproject.toml</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1775217600">- update to 2.22.0:
  * Added a new config option utf8_decode_errors for handling
    UTF-8 decode errors when parsing certain fields in SSH
    packets (disconnect error, debug message, userauth banner,
    channel open failure reason, channel exit signal reason, and
    SFTP error reason). The default continues to behave as
    before, raising a ProtocolError exception, but this option
    allows invalid bytes to be removed or replaced. Thanks go to
    GitHub user Le-Syl21 for suggesting this.
  * Changed config parser to Ignore subdirectories and parse only
    plain files matching a glob pattern in include directives,
    better matching the behavior of other SSH implementations.
    Thanks go to Jacopo Nespolo for contributing this change.
  * Improved a previous fix for a race condition which sometimes
    triggered assertion errors in SSHForwarder. Thanks go to Mike
    Barry for reporting the issue and helping to test the
    improved fix.
  * Removed optional dependency on libnacl/libsodium for chacha20
    and Edwrds curves, now that these are available in all
    supported versions of the cryptography package.
  * Updated asyncssh to use version 2 of the fido2 package, and
    update minimum Python version to 3.10, required by that
    updated package.
  * Fixed issue with the OpenSSL legacy provider on Windows and
    re-enabled OpenSSL use in unit tests on Windows.
  * Inproved "run multiple clients" example to show the hostname
    being accessed by each task.
  * Added unit testing for Python 3.14 and dropped 3.8 and 3.9.
- drop fido2-compat.patch (upstream)</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1781611200">- Update to 2.23.1
  * Fixed an SCP path traversal issue.
  * Expanded previous fix to block unsafe user substitutions in server config.
  * Fixed default value for reuse_address and reuse_port, matching the
    behavior of asyncio.create_server().
- Update to 2.23.0 (fixes CVE-2026-45309, bsc#1268333)
  * Added support for "Match localnetwork".
  * Enabled support for RSA with SHA-2 signatures in ssh-agent and Pageant.
  * Changed MAC algorithm negotation to be skipped when using AEAD ciphers.
  * Improved graceful termination when using ProxyCommand, waiting for the
    ProxyCommand tunnel to close when cleaning up a connection.
  * Blocked unsafe user substitutions from being used in server config.
  * Fixed an issue with config evaluation when "Match final" was combined
    with Hostname directives.
  * Fixed a resource leak in xauth support.
  * Fixed issue with multi-hop ProxyJump directives in a config file not
    working correctly.
  * Fixed string encoding in SFTPName objects returned by realpath().</changelog>
</package>
<package pkgid="0b20f947cec9522e09202b3b3fde466adbf1ce7071f4ae567bf9d70dd0b9ebeaee9b07efd6ed3f1fb10d5d4fdccbaf9e83f3db27114bcebac8e796971bf15f91" name="python313-cffi" arch="aarch64">
  <version epoch="0" ver="2.0.0" rel="117.10"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1673006400">- add 8a3c2c816d789639b49d3ae867213393ed7abdff.patch to resolve
  testsuite failures with Python 3.11</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1681387200">- Make calling of %{sle15modernpython} optional.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1682078400">- add sle15_python_module_pythons (jsc#PED-68)</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1696593600">- Clean up the SPEC file</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1696593601">- Upgrade to 1.16.0:
  - Add support for Python 3.12. With the removal of distutils
    from Python 3.12, projects using CFFI features that depend on
    distutils at runtime must add a dependency on setuptools to
    function under Python 3.12+. CFFI does not declare a runtime
    setuptools requirement to avoid an unnecessary dependency for
    projects that do not require it.
  - Drop support for end-of-life Python versions (2.7, 3.6, 3.7).
  - Move project source under src/; a more standard layout that
    also enables CI to more easily catch packaging errors.
  - Move project home to python-cffi/cffi on GitHub.
  - Add support for PEP517 builds; setuptools is now a required
    build dependency.
  - Declare python_requires metadata for Python 3.8+. This allows
    unsupported Pythons to continue using previously released
    sdists and wheels.
  - Add missing calls to PyObject_GC_UnTrack to avoid
    ResourceWarning 15c4b71
- Remove upstreamed patch
  8a3c2c816d789639b49d3ae867213393ed7abdff.patch</changelog>
  <changelog author="Dan &#x10C;erm&#xE1;k &lt;dcermak@suse.com&gt;" date="1709208000">- drop unnecessary buildrequire python-py</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1719748800">- add py313-compat.patch
  py313-use-format-unraisable.patch
  py313-use-hashpointer.patch: add upstream patches for py3.13
  support</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1725105600">- update to 1.17.0:
  * Add support for Python 3.13.
  * In API mode, when you get a function from a C library by writing
    `fn = lib.myfunc`, you get an object of a special type for
    performance reasons, instead of a `&lt;cdata 'C-function-type'&gt;`.
    Before version 1.17 you could only call such objects.
    You could write `ffi.addressof(lib, "myfunc")` in order to get
    a real `&lt;cdata&gt;` object, based on the idea that in these cases
    in C you'd usually write `&amp;myfunc` instead of `myfunc`.  In
    version 1.17, the special object `lib.myfunc` can now be passed
    in many places where CFFI expects
    a regular `&lt;cdata&gt;` object.  For example, you can now pass
    it as a callback to a C function call, or write it inside a C
    structure field of the correct pointer-to-function type, or use
    `ffi.cast()` or `ffi.typeof()` on it.
- drop py313-compat.patch, py313-use-format-unraisable.patch,
  py313-use-hashpointer.patch (upstream)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1728475200">- update to 1.17.1:
  * Fix failing distutils.msvc9compiler imports under Windows (#118).
  * ffibuilder.emit_python_code() and ffibuiler.emit_c_code()
    accept file-like objects (#115).
  * ffiplatform calls are bypassed by ffibuilder.emit_python_code()
    and ffibuilder.emit_c_code() (#81).</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1757851200">- update to 2.0.0:
  * Added support for free threaded CPython (3.14t+ only)
  * Added support for Python 3.14.
  * Dropped support for Python 3.8.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1773662400">- Add patch support-pycparser-3.patch:
  * Support pycparser 3 exception message changes.</changelog>
</package>
<package pkgid="b6526789cf0e28c9da8ede8ef9802f59920aaad48f7856e3e16c8422b1da0576989eaaadc5286c2cabfefc4d2c267f39f377dcbd391d6b121db4a4ec91004c3d" name="python313-cffi" arch="armv7hl">
  <version epoch="0" ver="2.0.0" rel="117.10"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1673006400">- add 8a3c2c816d789639b49d3ae867213393ed7abdff.patch to resolve
  testsuite failures with Python 3.11</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1681387200">- Make calling of %{sle15modernpython} optional.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1682078400">- add sle15_python_module_pythons (jsc#PED-68)</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1696593600">- Clean up the SPEC file</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1696593601">- Upgrade to 1.16.0:
  - Add support for Python 3.12. With the removal of distutils
    from Python 3.12, projects using CFFI features that depend on
    distutils at runtime must add a dependency on setuptools to
    function under Python 3.12+. CFFI does not declare a runtime
    setuptools requirement to avoid an unnecessary dependency for
    projects that do not require it.
  - Drop support for end-of-life Python versions (2.7, 3.6, 3.7).
  - Move project source under src/; a more standard layout that
    also enables CI to more easily catch packaging errors.
  - Move project home to python-cffi/cffi on GitHub.
  - Add support for PEP517 builds; setuptools is now a required
    build dependency.
  - Declare python_requires metadata for Python 3.8+. This allows
    unsupported Pythons to continue using previously released
    sdists and wheels.
  - Add missing calls to PyObject_GC_UnTrack to avoid
    ResourceWarning 15c4b71
- Remove upstreamed patch
  8a3c2c816d789639b49d3ae867213393ed7abdff.patch</changelog>
  <changelog author="Dan &#x10C;erm&#xE1;k &lt;dcermak@suse.com&gt;" date="1709208000">- drop unnecessary buildrequire python-py</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1719748800">- add py313-compat.patch
  py313-use-format-unraisable.patch
  py313-use-hashpointer.patch: add upstream patches for py3.13
  support</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1725105600">- update to 1.17.0:
  * Add support for Python 3.13.
  * In API mode, when you get a function from a C library by writing
    `fn = lib.myfunc`, you get an object of a special type for
    performance reasons, instead of a `&lt;cdata 'C-function-type'&gt;`.
    Before version 1.17 you could only call such objects.
    You could write `ffi.addressof(lib, "myfunc")` in order to get
    a real `&lt;cdata&gt;` object, based on the idea that in these cases
    in C you'd usually write `&amp;myfunc` instead of `myfunc`.  In
    version 1.17, the special object `lib.myfunc` can now be passed
    in many places where CFFI expects
    a regular `&lt;cdata&gt;` object.  For example, you can now pass
    it as a callback to a C function call, or write it inside a C
    structure field of the correct pointer-to-function type, or use
    `ffi.cast()` or `ffi.typeof()` on it.
- drop py313-compat.patch, py313-use-format-unraisable.patch,
  py313-use-hashpointer.patch (upstream)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1728475200">- update to 1.17.1:
  * Fix failing distutils.msvc9compiler imports under Windows (#118).
  * ffibuilder.emit_python_code() and ffibuiler.emit_c_code()
    accept file-like objects (#115).
  * ffiplatform calls are bypassed by ffibuilder.emit_python_code()
    and ffibuilder.emit_c_code() (#81).</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1757851200">- update to 2.0.0:
  * Added support for free threaded CPython (3.14t+ only)
  * Added support for Python 3.14.
  * Dropped support for Python 3.8.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1773662400">- Add patch support-pycparser-3.patch:
  * Support pycparser 3 exception message changes.</changelog>
</package>
<package pkgid="5e45f4c64f204dcd63e083f0f0a21c587da323fbe4ac6eedb02f737a4e527155e808d087479fe2dca33af774f8360e48c29f9c44b8c3010d11c340cbd0c8164a" name="python313-cffi" arch="x86_64">
  <version epoch="0" ver="2.0.0" rel="117.10"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1673006400">- add 8a3c2c816d789639b49d3ae867213393ed7abdff.patch to resolve
  testsuite failures with Python 3.11</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1681387200">- Make calling of %{sle15modernpython} optional.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1682078400">- add sle15_python_module_pythons (jsc#PED-68)</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1696593600">- Clean up the SPEC file</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1696593601">- Upgrade to 1.16.0:
  - Add support for Python 3.12. With the removal of distutils
    from Python 3.12, projects using CFFI features that depend on
    distutils at runtime must add a dependency on setuptools to
    function under Python 3.12+. CFFI does not declare a runtime
    setuptools requirement to avoid an unnecessary dependency for
    projects that do not require it.
  - Drop support for end-of-life Python versions (2.7, 3.6, 3.7).
  - Move project source under src/; a more standard layout that
    also enables CI to more easily catch packaging errors.
  - Move project home to python-cffi/cffi on GitHub.
  - Add support for PEP517 builds; setuptools is now a required
    build dependency.
  - Declare python_requires metadata for Python 3.8+. This allows
    unsupported Pythons to continue using previously released
    sdists and wheels.
  - Add missing calls to PyObject_GC_UnTrack to avoid
    ResourceWarning 15c4b71
- Remove upstreamed patch
  8a3c2c816d789639b49d3ae867213393ed7abdff.patch</changelog>
  <changelog author="Dan &#x10C;erm&#xE1;k &lt;dcermak@suse.com&gt;" date="1709208000">- drop unnecessary buildrequire python-py</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1719748800">- add py313-compat.patch
  py313-use-format-unraisable.patch
  py313-use-hashpointer.patch: add upstream patches for py3.13
  support</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1725105600">- update to 1.17.0:
  * Add support for Python 3.13.
  * In API mode, when you get a function from a C library by writing
    `fn = lib.myfunc`, you get an object of a special type for
    performance reasons, instead of a `&lt;cdata 'C-function-type'&gt;`.
    Before version 1.17 you could only call such objects.
    You could write `ffi.addressof(lib, "myfunc")` in order to get
    a real `&lt;cdata&gt;` object, based on the idea that in these cases
    in C you'd usually write `&amp;myfunc` instead of `myfunc`.  In
    version 1.17, the special object `lib.myfunc` can now be passed
    in many places where CFFI expects
    a regular `&lt;cdata&gt;` object.  For example, you can now pass
    it as a callback to a C function call, or write it inside a C
    structure field of the correct pointer-to-function type, or use
    `ffi.cast()` or `ffi.typeof()` on it.
- drop py313-compat.patch, py313-use-format-unraisable.patch,
  py313-use-hashpointer.patch (upstream)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1728475200">- update to 1.17.1:
  * Fix failing distutils.msvc9compiler imports under Windows (#118).
  * ffibuilder.emit_python_code() and ffibuiler.emit_c_code()
    accept file-like objects (#115).
  * ffiplatform calls are bypassed by ffibuilder.emit_python_code()
    and ffibuilder.emit_c_code() (#81).</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1757851200">- update to 2.0.0:
  * Added support for free threaded CPython (3.14t+ only)
  * Added support for Python 3.14.
  * Dropped support for Python 3.8.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1773662400">- Add patch support-pycparser-3.patch:
  * Support pycparser 3 exception message changes.</changelog>
</package>
<package pkgid="bb4c8dcb424175a9827e9661b874a8ffe1106a8bfa0287a93e604011a24734fcf28d469ded4524e6a9e528b8e0abfd0f7c4f32302a04fbb9dde2b8f95e1a4d01" name="python313-cffi-debuginfo" arch="aarch64">
  <version epoch="0" ver="2.0.0" rel="117.10"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1673006400">- add 8a3c2c816d789639b49d3ae867213393ed7abdff.patch to resolve
  testsuite failures with Python 3.11</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1681387200">- Make calling of %{sle15modernpython} optional.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1682078400">- add sle15_python_module_pythons (jsc#PED-68)</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1696593600">- Clean up the SPEC file</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1696593601">- Upgrade to 1.16.0:
  - Add support for Python 3.12. With the removal of distutils
    from Python 3.12, projects using CFFI features that depend on
    distutils at runtime must add a dependency on setuptools to
    function under Python 3.12+. CFFI does not declare a runtime
    setuptools requirement to avoid an unnecessary dependency for
    projects that do not require it.
  - Drop support for end-of-life Python versions (2.7, 3.6, 3.7).
  - Move project source under src/; a more standard layout that
    also enables CI to more easily catch packaging errors.
  - Move project home to python-cffi/cffi on GitHub.
  - Add support for PEP517 builds; setuptools is now a required
    build dependency.
  - Declare python_requires metadata for Python 3.8+. This allows
    unsupported Pythons to continue using previously released
    sdists and wheels.
  - Add missing calls to PyObject_GC_UnTrack to avoid
    ResourceWarning 15c4b71
- Remove upstreamed patch
  8a3c2c816d789639b49d3ae867213393ed7abdff.patch</changelog>
  <changelog author="Dan &#x10C;erm&#xE1;k &lt;dcermak@suse.com&gt;" date="1709208000">- drop unnecessary buildrequire python-py</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1719748800">- add py313-compat.patch
  py313-use-format-unraisable.patch
  py313-use-hashpointer.patch: add upstream patches for py3.13
  support</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1725105600">- update to 1.17.0:
  * Add support for Python 3.13.
  * In API mode, when you get a function from a C library by writing
    `fn = lib.myfunc`, you get an object of a special type for
    performance reasons, instead of a `&lt;cdata 'C-function-type'&gt;`.
    Before version 1.17 you could only call such objects.
    You could write `ffi.addressof(lib, "myfunc")` in order to get
    a real `&lt;cdata&gt;` object, based on the idea that in these cases
    in C you'd usually write `&amp;myfunc` instead of `myfunc`.  In
    version 1.17, the special object `lib.myfunc` can now be passed
    in many places where CFFI expects
    a regular `&lt;cdata&gt;` object.  For example, you can now pass
    it as a callback to a C function call, or write it inside a C
    structure field of the correct pointer-to-function type, or use
    `ffi.cast()` or `ffi.typeof()` on it.
- drop py313-compat.patch, py313-use-format-unraisable.patch,
  py313-use-hashpointer.patch (upstream)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1728475200">- update to 1.17.1:
  * Fix failing distutils.msvc9compiler imports under Windows (#118).
  * ffibuilder.emit_python_code() and ffibuiler.emit_c_code()
    accept file-like objects (#115).
  * ffiplatform calls are bypassed by ffibuilder.emit_python_code()
    and ffibuilder.emit_c_code() (#81).</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1757851200">- update to 2.0.0:
  * Added support for free threaded CPython (3.14t+ only)
  * Added support for Python 3.14.
  * Dropped support for Python 3.8.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1773662400">- Add patch support-pycparser-3.patch:
  * Support pycparser 3 exception message changes.</changelog>
</package>
<package pkgid="ac9727f360f3d3d945a010c90797105a46f2481a4cc6ea64fa7e840725cf64d5b581a3e54471da05fd08d47356b0af974bc6d1aef9263dc3d4daf9fadc449a03" name="python313-cffi-debuginfo" arch="armv7hl">
  <version epoch="0" ver="2.0.0" rel="117.10"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1673006400">- add 8a3c2c816d789639b49d3ae867213393ed7abdff.patch to resolve
  testsuite failures with Python 3.11</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1681387200">- Make calling of %{sle15modernpython} optional.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1682078400">- add sle15_python_module_pythons (jsc#PED-68)</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1696593600">- Clean up the SPEC file</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1696593601">- Upgrade to 1.16.0:
  - Add support for Python 3.12. With the removal of distutils
    from Python 3.12, projects using CFFI features that depend on
    distutils at runtime must add a dependency on setuptools to
    function under Python 3.12+. CFFI does not declare a runtime
    setuptools requirement to avoid an unnecessary dependency for
    projects that do not require it.
  - Drop support for end-of-life Python versions (2.7, 3.6, 3.7).
  - Move project source under src/; a more standard layout that
    also enables CI to more easily catch packaging errors.
  - Move project home to python-cffi/cffi on GitHub.
  - Add support for PEP517 builds; setuptools is now a required
    build dependency.
  - Declare python_requires metadata for Python 3.8+. This allows
    unsupported Pythons to continue using previously released
    sdists and wheels.
  - Add missing calls to PyObject_GC_UnTrack to avoid
    ResourceWarning 15c4b71
- Remove upstreamed patch
  8a3c2c816d789639b49d3ae867213393ed7abdff.patch</changelog>
  <changelog author="Dan &#x10C;erm&#xE1;k &lt;dcermak@suse.com&gt;" date="1709208000">- drop unnecessary buildrequire python-py</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1719748800">- add py313-compat.patch
  py313-use-format-unraisable.patch
  py313-use-hashpointer.patch: add upstream patches for py3.13
  support</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1725105600">- update to 1.17.0:
  * Add support for Python 3.13.
  * In API mode, when you get a function from a C library by writing
    `fn = lib.myfunc`, you get an object of a special type for
    performance reasons, instead of a `&lt;cdata 'C-function-type'&gt;`.
    Before version 1.17 you could only call such objects.
    You could write `ffi.addressof(lib, "myfunc")` in order to get
    a real `&lt;cdata&gt;` object, based on the idea that in these cases
    in C you'd usually write `&amp;myfunc` instead of `myfunc`.  In
    version 1.17, the special object `lib.myfunc` can now be passed
    in many places where CFFI expects
    a regular `&lt;cdata&gt;` object.  For example, you can now pass
    it as a callback to a C function call, or write it inside a C
    structure field of the correct pointer-to-function type, or use
    `ffi.cast()` or `ffi.typeof()` on it.
- drop py313-compat.patch, py313-use-format-unraisable.patch,
  py313-use-hashpointer.patch (upstream)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1728475200">- update to 1.17.1:
  * Fix failing distutils.msvc9compiler imports under Windows (#118).
  * ffibuilder.emit_python_code() and ffibuiler.emit_c_code()
    accept file-like objects (#115).
  * ffiplatform calls are bypassed by ffibuilder.emit_python_code()
    and ffibuilder.emit_c_code() (#81).</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1757851200">- update to 2.0.0:
  * Added support for free threaded CPython (3.14t+ only)
  * Added support for Python 3.14.
  * Dropped support for Python 3.8.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1773662400">- Add patch support-pycparser-3.patch:
  * Support pycparser 3 exception message changes.</changelog>
</package>
<package pkgid="faa2f9b29e7b5a0719323fa9f5c3cb63d88a6e7590d82d3a0b4c11f70a47d94d80a110c371e82110c7314b3c3caba13c7e3da81083b8fca9a32f5e2634e3140c" name="python313-cffi-debuginfo" arch="x86_64">
  <version epoch="0" ver="2.0.0" rel="117.10"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1673006400">- add 8a3c2c816d789639b49d3ae867213393ed7abdff.patch to resolve
  testsuite failures with Python 3.11</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1681387200">- Make calling of %{sle15modernpython} optional.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1682078400">- add sle15_python_module_pythons (jsc#PED-68)</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1696593600">- Clean up the SPEC file</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1696593601">- Upgrade to 1.16.0:
  - Add support for Python 3.12. With the removal of distutils
    from Python 3.12, projects using CFFI features that depend on
    distutils at runtime must add a dependency on setuptools to
    function under Python 3.12+. CFFI does not declare a runtime
    setuptools requirement to avoid an unnecessary dependency for
    projects that do not require it.
  - Drop support for end-of-life Python versions (2.7, 3.6, 3.7).
  - Move project source under src/; a more standard layout that
    also enables CI to more easily catch packaging errors.
  - Move project home to python-cffi/cffi on GitHub.
  - Add support for PEP517 builds; setuptools is now a required
    build dependency.
  - Declare python_requires metadata for Python 3.8+. This allows
    unsupported Pythons to continue using previously released
    sdists and wheels.
  - Add missing calls to PyObject_GC_UnTrack to avoid
    ResourceWarning 15c4b71
- Remove upstreamed patch
  8a3c2c816d789639b49d3ae867213393ed7abdff.patch</changelog>
  <changelog author="Dan &#x10C;erm&#xE1;k &lt;dcermak@suse.com&gt;" date="1709208000">- drop unnecessary buildrequire python-py</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1719748800">- add py313-compat.patch
  py313-use-format-unraisable.patch
  py313-use-hashpointer.patch: add upstream patches for py3.13
  support</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1725105600">- update to 1.17.0:
  * Add support for Python 3.13.
  * In API mode, when you get a function from a C library by writing
    `fn = lib.myfunc`, you get an object of a special type for
    performance reasons, instead of a `&lt;cdata 'C-function-type'&gt;`.
    Before version 1.17 you could only call such objects.
    You could write `ffi.addressof(lib, "myfunc")` in order to get
    a real `&lt;cdata&gt;` object, based on the idea that in these cases
    in C you'd usually write `&amp;myfunc` instead of `myfunc`.  In
    version 1.17, the special object `lib.myfunc` can now be passed
    in many places where CFFI expects
    a regular `&lt;cdata&gt;` object.  For example, you can now pass
    it as a callback to a C function call, or write it inside a C
    structure field of the correct pointer-to-function type, or use
    `ffi.cast()` or `ffi.typeof()` on it.
- drop py313-compat.patch, py313-use-format-unraisable.patch,
  py313-use-hashpointer.patch (upstream)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1728475200">- update to 1.17.1:
  * Fix failing distutils.msvc9compiler imports under Windows (#118).
  * ffibuilder.emit_python_code() and ffibuiler.emit_c_code()
    accept file-like objects (#115).
  * ffiplatform calls are bypassed by ffibuilder.emit_python_code()
    and ffibuilder.emit_c_code() (#81).</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1757851200">- update to 2.0.0:
  * Added support for free threaded CPython (3.14t+ only)
  * Added support for Python 3.14.
  * Dropped support for Python 3.8.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1773662400">- Add patch support-pycparser-3.patch:
  * Support pycparser 3 exception message changes.</changelog>
</package>
<package pkgid="ca2f2b0c692638c42214eb850a078e9397acf5ca4ad1a5ae62d1dc003f03cef293747a556bd2d31bf62d563c87834624461866675201e4c731c1c07b456e3bb5" name="python313-cryptography" arch="aarch64">
  <version epoch="0" ver="49.0.0" rel="289.3"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1727524800">- update to 43.0.1:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.3.2.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1729598400">- update to 43.0.3:
  * Fixed release metadata for cryptography-vectors
  * Fixed compilation when using LibreSSL 4.0.0.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1730808000">- Avoid using requires_eq, which after the last modifications
  conflicts with python singlespec (order of expansion).</changelog>
  <changelog author="Ben Greiner &lt;code@bnavigator.de&gt;" date="1731067200">- Fix requires_eq replacement for distributions which do not have
  python3-cffi installed (such as SLE15 python module pythons)
  * gh#openSUSE/python-rpm-macros#185
- Remove outdated section in description</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfyhalomacro@opensuse.org&gt;" date="1737892800">- Update to version 44.0.0:
  * BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL &lt; 3.9.
  * Deprecated Python 3.7 support. Python 3.7 is no longer supported by
    the Python core team. Support for Python 3.7 will be removed in a future
    cryptography release.
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.4.0.
  * macOS wheels are now built against the macOS 10.13 SDK. Users on older
    versions of macOS should upgrade, or they will need to build cryptography
    themselves.
  * Enforce the RFC 5280 requirement that extended key usage extensions must not be empty.
  * Added support for timestamp extraction to the :class:`~cryptography.fernet.MultiFernet` class.
  * Relax the Authority Key Identifier requirements on root CA certificates
    during X.509 verification to allow fields permitted by RFC 5280 but
    forbidden by the CA/Browser BRs.
  * Added support for
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2id` when using
    OpenSSL 3.2.0+.
  * Added support for the :class:`~cryptography.x509.Admissions` certificate extension.
  * Added basic support for PKCS7 decryption (including S/MIME 3.2) via
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der`,
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_pem`,
    and :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_smime`.
- Update specfile to accommodate new project structure at version 44.0.0
- Update no-pytest_benchmark.patch</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1740571200">- update to 44.0.1:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.4.1.
  * We now build armv7l manylinux wheels and publish them to
    PyPI.
  * We now build manylinux_2_34 wheels and publish them to PyPI.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1742731200">- update to 44.0.2:
  * We now build wheels for PyPy 3.11.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1746619200">- Update to 44.0.3
  * Fixed compilation when using LibreSSL 4.1.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1752321600">- update to 45.0.5:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.1.
  * Fixed decrypting PKCS#8 files encrypted with SHA1-RC4. (This
    is not considered secure, and is supported only for backwards
    compatibility.)
  * Fixed decrypting PKCS#8 files encrypted with long salts (this
    impacts keys encrypted by Bouncy Castle).
  * Fixed decrypting PKCS#8 files encrypted with DES-CBC-MD5.
    While wildly insecure, this remains prevalent.
  * Fixed using mypy with cryptography on older versions of
    Python.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.0.
  * Support for Python 3.7 is deprecated and will be removed in
    the next cryptography release.
  * Updated the minimum supported Rust version (MSRV) to 1.74.0,
    from 1.65.0.
  * Added support for serialization of PKCS#12 Java truststores
    in :func:`~cryptography.hazmat.primitives.serialization.pkcs1
    2.serialize_java_truststore`
  * Added :meth:`~cryptography.hazmat.primitives.kdf.argon2.Argon
    2id.derive_phc_encoded` and :meth:`~cryptography.hazmat.primi
    tives.kdf.argon2.Argon2id.verify_phc_encoded` methods to
    support password hashing in the PHC string format
  * Added support for PKCS7 decryption and encryption using
    AES-256 as the content algorithm, in addition to AES-128.
  * BACKWARDS INCOMPATIBLE: Made SSH private key loading more
    consistent with other private key loading: :func:`~cryptograp
    hy.hazmat.primitives.serialization.load_ssh_private_key` now
    raises a TypeError if the key is unencrypted but a password
    is provided (previously no exception was raised), and raises
    a TypeError if the key is encrypted but no password is
    provided (previously a ValueError was raised).
  * Added __copy__ to the :class:`~cryptography.hazmat.primitives
    .asymmetric.ec.EllipticCurvePrivateKey`, :class:`~cryptograph
    y.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey`, :c
    lass:`~cryptography.hazmat.primitives.asymmetric.ed25519.Ed25
    519PublicKey`, :class:`~cryptography.hazmat.primitives.asymme
    tric.ed25519.Ed25519PrivateKey`, :class:`~cryptography.hazmat
    .primitives.asymmetric.ed448.Ed448PublicKey`, :class:`~crypto
    graphy.hazmat.primitives.asymmetric.ed448.Ed448PrivateKey`, :
    class:`~cryptography.hazmat.primitives.asymmetric.x25519.X255
    19PublicKey`, :class:`~cryptography.hazmat.primitives.asymmet
    ric.x25519.X25519PrivateKey`, :class:`~cryptography.hazmat.pr
    imitives.asymmetric.x448.X448PublicKey`, :class:`~cryptograph
    y.hazmat.primitives.asymmetric.x448.X448PrivateKey`, :class:`
    ~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey`
    , :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAP
    ublicKey`, :class:`~cryptography.hazmat.primitives.asymmetric
    .dsa.DSAPrivateKey`, :class:`~cryptography.hazmat.primitives.
    asymmetric.dsa.DSAPublicKey`, :class:`~cryptography.hazmat.pr
    imitives.asymmetric.dh.DHPrivateKey`, and :class:`~cryptograp
    hy.hazmat.primitives.asymmetric.dh.DHPublicKey` abstract base
    classes.
  * We significantly refactored how private key loading ( :func:`
    ~cryptography.hazmat.primitives.serialization.load_pem_privat
    e_key` and :func:`~cryptography.hazmat.primitives.serializati
    on.load_der_private_key`) works. This is intended to be
    backwards compatible for all well-formed keys, therefore if
    you discover a key that now raises an exception, please file
    a bug with instructions for reproducing.
  * Added unsafe_skip_rsa_key_validation keyword-argument to :fun
    c:`~cryptography.hazmat.primitives.serialization.load_ssh_pri
    vate_key`.
  * Added :class:`~cryptography.hazmat.primitives.hashes.XOFHash`
    to support repeated :meth:`~cryptography.hazmat.primitives.ha
    shes.XOFHash.squeeze` operations on extendable output
    functions.
  * Added :meth:`~cryptography.x509.ocsp.OCSPResponseBuilder.add_
    response_by_hash` method to allow creating OCSP responses
    using certificate hash values rather than full certificates.
  * Extended the :mod:`X.509 path validation
    &lt;cryptography.x509.verification&gt;` API to support user-
    configured extension policies via the
    :meth:`PolicyBuilder.extension_policies &lt;cryptography.x509.ve
    rification.PolicyBuilder.extension_policies&gt;` method.
  * Deprecated the subject, verification_time and max_chain_depth
    properties on
    :class:`~cryptography.x509.verification.ClientVerifier` and
    :class:`~cryptography.x509.verification.ServerVerifier` in
    favor of a new policy property. These properties will be
    removed in the next release of cryptography.
  * BACKWARDS INCOMPATIBLE: The :meth:`VerifiedClient.subject
    &lt;cryptography.x509.verification.VerifiedClient.subjects&gt;`
    property can now be None since a custom extension policy may
    allow certificates without a Subject Alternative Name
    extension.
  * Changed the behavior when the OpenSSL 3 legacy provider fails
    to load. Instead of raising an exception, a warning is now
    emitted. The CRYPTOGRAPHY_OPENSSL_NO_LEGACY environment
    variable can still be used to disable the legacy provider at
    runtime.
  * Added support for the CRYPTOGRAPHY_BUILD_OPENSSL_NO_LEGACY
    environment variable during build time, which prevents the
    library from ever attempting to load the legacy provider.
  * Added support for the
    :class:`~cryptography.x509.PrivateKeyUsagePeriod` X.509
    extension. This extension defines the period during which the
    private key corresponding to the certificate's public key may
    be used.
  * Added support for compiling against `aws-lc`_.
  * Parsing X.509 structures now more strictly enforces that Name
    structures do not have malformed ASN.1.
  * We now publish py311 wheels that utilize the faster
    pyo3::buffer::PyBuffer interface, resulting in significantly
    improved performance for operations involving small buffers.
  * Added :func:`~cryptography.hazmat.primitives.serialization.ss
    h_key_fingerprint` for computing fingerprints of SSH public
    keys.
  * Added support for deterministic ECDSA signing via the new
    keyword-only argument ecdsa_deterministic in
    :meth:`~cryptography.x509.CertificateBuilder.sign`, :meth:`~c
    ryptography.x509.CertificateRevocationListBuilder.sign` and :
    meth:`~cryptography.x509.CertificateSigningRequestBuilder.sig
    n`.</changelog>
  <changelog author="James Oakley &lt;jfunk@opensuse.org&gt;" date="1756728000">- Add Make-unsafe-subinterpreter-support-available-via-cfg.patch
  to allow ceph-mgr to load modules (boo#1248987)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1757851200">- update to 45.0.7:
  * Added a function to support an upcoming pyOpenSSL release.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1760356800">- update to 46.0.2:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.4.
  * Fixed an issue where users installing via pip on Python 3.14
    development versions would not properly install a dependency.
  * Fixed an issue building the free-threaded macOS 3.14 wheels.
  * BACKWARDS INCOMPATIBLE: Support for Python 3.7 has been
    removed.
  * Support for OpenSSL &lt; 3.0 is deprecated and will be removed
    in the next release.
  * Support for x86_64 macOS (including publishing wheels) is
    deprecated and will be removed in two releases. We will
    switch to publishing an arm64 only wheel for macOS.
  * Support for 32-bit Windows (including publishing wheels) is
    deprecated and will be removed in two releases. Users should
    move to a 64-bit Python installation.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.3.
  * We now build ppc64le manylinux wheels and publish them to
    PyPI.
  * We now build win_arm64 (Windows on Arm) wheels and publish
    them to PyPI.
  * Added support for free-threaded Python 3.14.
  * Removed the deprecated get_attribute_for_oid method on
    :class:`~cryptography.x509.CertificateSigningRequest`. Users
    should use
    :meth:`~cryptography.x509.Attributes.get_attribute_for_oid`
    instead.
  * Removed the deprecated CAST5, SEED, IDEA, and Blowfish
    classes from the cipher module. These are still available in
    :doc:`/hazmat/decrepit/index`.
  * In X.509, when performing a PSS signature with a SHA-3 hash,
    it is now encoded with the official NIST SHA3 OID.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1765195200">- Only require pytest-subtests with pytest &lt; 9.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1770897600">- Update to 46.0.5 (fixes CVE-2026-26007, bsc#1258074)
  * An attacker could create a malicious public key that reveals portions of
    your private key when using certain uncommon elliptic curves (binary
    curves). This version now includes additional security checks to prevent
    this attack. This issue only affects binary elliptic curves, which are
    rarely used in real-world applications. Credit to XlabAI Team of Tencent
    Xuanwu Lab and Atuin Automated Vulnerability Discovery Engine for reporting
    the issue. CVE-2026-26007
  * Support for SECT* binary elliptic curves is deprecated and will be removed
    in the next release.
- Update to 46.0.4
  * Dropped support for win_arm64 wheels.
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.5.
- Update to 46.0.3
  * Fixed compilation when using LibreSSL 4.2.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1774612800">- update to 46.0.6 (CVE-2026-34073, bsc#1260876):
  * SECURITY ISSUE: Fixed a bug where name constraints were not
    applied to peer names during verification when the leaf
    certificate contains a wildcard DNS SAN. Ordinary X.509
    topologies are not affected by this bug, including those used
    by the Web PKI. Credit to Oleh Konko (1seal) for reporting
    the issue. CVE-2026-34073</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1774958400">- Add patch support-maturin-1.12.patch:
  * Correctly deal with maturin bugfix that installs tests and
    docs under sitearch.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1775822400">- Update to 46.0.7 (fixes CVE-2026-39892, bsc#1261863)
  * **SECURITY ISSUE**: Fixed an issue where non-contiguous buffers could be
    passed to APIs that accept Python buffers, which could lead to buffer
    overflow. **CVE-2026-39892**
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.6.
- drop support-maturin-1.12.patch (upstream)
- drop no-pytest_benchmark.patch,
  Make-unsafe-subinterpreter-support-available-via-cfg.patch:
  obsolete</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1777204800">- update to 47.0.0:
  * Support for Python 3.8 is deprecated and will be removed in
    the next cryptography release.
  * BACKWARDS INCOMPATIBLE: Support for binary elliptic curves
    (SECT* classes) has been removed. These curves are rarely
    used and have additional security considerations that make
    them undesirable.
  * BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.1.x has been
    removed. OpenSSL 3.0.0 or later is now required. LibreSSL,
    BoringSSL, and AWS-LC continue to be supported.
  * BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL &lt; 4.1.
  * BACKWARDS INCOMPATIBLE: Loading keys with unsupported
    algorithms or keys with unsupported explicit curve encodings
    now raises
    :class:`~cryptography.exceptions.UnsupportedAlgorithm`
    instead of ValueError. This change affects :func:`~cryptograp
    hy.hazmat.primitives.serialization.load_pem_private_key`, :fu
    nc:`~cryptography.hazmat.primitives.serialization.load_der_pr
    ivate_key`, :func:`~cryptography.hazmat.primitives.serializat
    ion.load_pem_public_key`, :func:`~cryptography.hazmat.primiti
    ves.serialization.load_der_public_key`, and
    :meth:`~cryptography.x509.Certificate.public_key` when called
    on certificates with unsupported public key algorithms.
  * BACKWARDS INCOMPATIBLE: When parsing elliptic curve private
    keys, we now reject keys that incorrectly encode a private
    key of the wrong length because such keys are impossible to
    process in a constant-time manner. We do not believe keys
    with this problem are in wide use, however we may revert this
    change based on the feedback we receive.
  * Deprecated passing 64-bit (8-byte) and 128-bit (16-byte) keys
    to :class:`~cryptography.hazmat.decrepit.ciphers.algorithms.T
    ripleDES`. In a future release, only 192-bit (24-byte) keys
    will be accepted. Users should expand shorter keys themselves
    (e.g., for single DES: key + key + key, for two-key: key +
    key[:8]).
  * Updated the minimum supported Rust version (MSRV) to 1.83.0,
    from 1.74.0.
  * Support for x86_64 macOS (including publishing wheels) is
    deprecated and will be removed in the next release. We will
    switch to publishing an arm64 only wheel for macOS.
  * Support for 32-bit Windows (including publishing wheels) is
    deprecated and will be removed in the next release. Users
    should move to a 64-bit Python installation.
  * public_bytes and private_bytes methods on keys now raise
    TypeError (instead of ValueError) if an invalid encoding is
    provided for the given format.
  * Moved
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.CFB`,
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.OFB`, and
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.CFB8`
    into :doc:`/hazmat/decrepit/index` and deprecated them in the
    modes module. They will be removed from the modes module in
    49.0.0.
  * Moved :class:`~cryptography.hazmat.primitives.ciphers.algorit
    hms.Camellia` into  :doc:`/hazmat/decrepit/index` and
    deprecated it in the cipher module. It will be removed from
    the cipher module in 49.0.0.
  * Added
    :meth:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF.extract`
    to :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF`.
    The previous private implementation will be removed in
    49.0.0.
  * Added support for loading elliptic curve keys that contain
    explicit encodings of the curves secp256r1, secp384r1, and
    secp521r1.
  * Added support for
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2d`
    and
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2i`
    when using OpenSSL 3.2.0+.
  * Added derive_into methods to
    :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF`,
    :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDFExpand`,
    :class:`~cryptography.hazmat.primitives.kdf.concatkdf.ConcatK
    DFHash`, :class:`~cryptography.hazmat.primitives.kdf.concatkd
    f.ConcatKDFHMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2id`,
    :class:`~cryptography.hazmat.primitives.kdf.pbkdf2.PBKDF2HMAC
    `,
    :class:`~cryptography.hazmat.primitives.kdf.kbkdf.KBKDFHMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.kbkdf.KBKDFCMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.scrypt.Scrypt`,
    and
    :class:`~cryptography.hazmat.primitives.kdf.x963kdf.X963KDF`
    to allow deriving keys directly into pre-allocated buffers.
  * Added encrypt_into and decrypt_into methods to
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESCCM`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESGCM`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESGCMSI
    V`, :class:`~cryptography.hazmat.primitives.ciphers.aead.AESO
    CB3`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESSIV`,
    and :class:`~cryptography.hazmat.primitives.ciphers.aead.ChaC
    ha20Poly1305` to allow encrypting directly into a pre-
    allocated buffer.
  * Added support for PKCS1v15 signing without DigestInfo using :
    class:`~cryptography.hazmat.primitives.asymmetric.utils.NoDig
    estInfo`.
  * Added
    :meth:`~cryptography.hazmat.primitives.hashes.Hash.hash`, a
    one-shot method for computing hashes.
  * Added :doc:`/hazmat/primitives/hpke` support implementing RFC
    9180 for hybrid authenticated encryption.
  * Added new :doc:`/hazmat/primitives/asymmetric/mlkem` module
    with support for ML-KEM key encapsulation with AWS-LC and
    BoringSSL. Note: Post-quantum algorithm support requires AWS-
    LC or BoringSSL. As we ship our wheels with OpenSSL, most
    users will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Note: Post-quantum algorithm support requires AWS-LC or
    BoringSSL. As we ship our wheels with OpenSSL, most users
    will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Added new :doc:`/hazmat/primitives/asymmetric/mldsa` module
    with support for ML-DSA signing and verification with AWS-LC
    and BoringSSL. Note: Post-quantum algorithm support requires
    AWS-LC or BoringSSL. As we ship our wheels with OpenSSL, most
    users will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Note: Post-quantum algorithm support requires AWS-LC or
    BoringSSL. As we ship our wheels with OpenSSL, most users
    will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Added new :doc:`/hazmat/asn1/index` module with support for
    declaratively defining custom ASN.1 types and
    encoding/decoding them.
  * Fixed compilation when using LibreSSL 4.3.0 and OpenSSL
    4.0.0.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 4.0.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1778414400">- update to 48.0.0:
  * BACKWARDS INCOMPATIBLE: Support for Python 3.8 has been
    removed. cryptography now requires Python 3.9 or later.
  * BACKWARDS INCOMPATIBLE: Loading an X.509 CRL whose inner
    TBSCertList.signature algorithm does not match the outer
    signatureAlgorithm now raises ValueError. Previously, such
    CRLs were parsed successfully and only rejected during
    signature validation.
  * Added support for :doc:`/hazmat/primitives/asymmetric/mlkem`
    and :doc:`/hazmat/primitives/asymmetric/mldsa` when using
    OpenSSL 3.5.0 or later, in addition to the existing AWS-LC
    and BoringSSL support. This means post-quantum algorithms are
    now available to users of our wheels. Note: Going forward, we
    do not guarantee that all functionality in cryptography will
    be available when building against OpenSSL. See
    :doc:`/statements/state-of-openssl` for more information.
  * Note: Going forward, we do not guarantee that all
    functionality in cryptography will be available when building
    against OpenSSL. See :doc:`/statements/state-of-openssl` for
    more information.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1781438400">- update to 49.0.0:
  * BACKWARDS INCOMPATIBLE: Removed the deprecated
    PUBLIC_KEY_TYPES, PRIVATE_KEY_TYPES,
    CERTIFICATE_PRIVATE_KEY_TYPES,
    CERTIFICATE_ISSUER_PUBLIC_KEY_TYPES, and
    CERTIFICATE_PUBLIC_KEY_TYPES type aliases. Use
    PublicKeyTypes, PrivateKeyTypes,
    CertificateIssuerPrivateKeyTypes,
    CertificateIssuerPublicKeyTypes, and
    CertificatePublicKeyTypes instead. These were deprecated in
    version 40.0.
  * BACKWARDS INCOMPATIBLE: :class:`~cryptography.hazmat.primitiv
    es.ciphers.algorithms.ChaCha20` now treats the first 4 bytes
    of the nonce as a 32-bit little-endian block counter (as
    defined in RFC 7539) and tracks the number of bytes
    processed. Attempting to encrypt or decrypt more data than
    the counter allows before it would overflow now raises a
    :class:`ValueError` rather than silently diverging from RFC
    7539. Setting the counter portion of the nonce to zero allows
    encrypting up to 256 GiB with a given nonce.
  * BACKWARDS INCOMPATIBLE: Loading an X.509 certificate whose
    ECDSA or DSA signature AlgorithmIdentifier contains encoded
    NULL parameters now raises a :class:`ValueError`. Such
    certificates are invalid, but older versions of Java emitted
    them; previously they loaded with a deprecation warning.
  * Fixed cross-compilation of the CFFI bindings when
    PYO3_CROSS_LIB_DIR is set. The build now derives the Python
    include directory from PYO3_CROSS_LIB_DIR instead of querying
    the host interpreter, which previously caused the build to
    fail during cross-compilations for embedded systems, on hosts
    which have same-version Python development headers installed
    as the target Python.
  * Added support for signing and verifying X.509 certificates,
    certificate signing requests, and certificate revocation
    lists with :doc:`/hazmat/primitives/asymmetric/mldsa` keys,
    as well as loading certificates that contain ML-DSA public
    keys.
  * Added
    :meth:`~cryptography.hazmat.primitives.hpke.KEM.enc_length`
    to :class:`~cryptography.hazmat.primitives.hpke.KEM` so
    callers can split the encapsulated key from the ciphertext
    returned by
    :meth:`~cryptography.hazmat.primitives.hpke.Suite.encrypt`.
  * :meth:`~cryptography.x509.verification.ExtensionPolicy.requir
    e_present`, :meth:`~cryptography.x509.verification.ExtensionP
    olicy.may_be_present`, and :meth:`~cryptography.x509.verifica
    tion.ExtensionPolicy.require_not_present` now accept any
    extension type. Previously only a fixed set of extension
    types was supported, which made it impossible to account for
    otherwise unrecognized critical extensions during path
    validation.
  * Added support for using
    :class:`~cryptography.x509.Certificate`,
    :class:`~cryptography.x509.CertificateSigningRequest`, and
    :class:`~cryptography.x509.CertificateRevocationList` as
    field types in :doc:`/hazmat/asn1/index` structures.
  * Added :func:`~cryptography.hazmat.asn1.value_set`, a class
    decorator that registers an :class:`enum.Enum` subclass as an
    ASN.1 value set: members are encoded as their underlying
    value, and decoding fails if the decoded value does not match
    one of the declared members.
  * Added :meth:`~cryptography.x509.Name.from_bytes` for parsing
    a :class:`~cryptography.x509.Name` from DER bytes, the
    inverse of :meth:`~cryptography.x509.Name.public_bytes`.
  * Added the rsa_padding keyword-only parameter to
    :meth:`~cryptography.x509.CertificateBuilder.public_key`.
    Passing the :class:`~cryptography.hazmat.primitives.asymmetri
    c.padding.PSS` class (not an instance) encodes an RSA subject
    public key in the certificate's subjectPublicKeyInfo with the
    id-RSASSA-PSS OID and no parameters.
  * Added external mu (message representative) support to
    :doc:`/hazmat/primitives/asymmetric/mldsa` via the sign_mu
    and verify_mu methods, which sign and verify a precomputed
    64-byte mu as defined in FIPS 204.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 4.0.1.</changelog>
</package>
<package pkgid="ce9771a6213f6dac66f63a5d5a261e26f5baeabb240a2bac818b5b2d4a4666ade961f9561c6b98eb0cdb7d7f775f7d208e5cec1e40801922297f6c60448b0140" name="python313-cryptography" arch="armv7hl">
  <version epoch="0" ver="49.0.0" rel="289.3"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1727524800">- update to 43.0.1:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.3.2.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1729598400">- update to 43.0.3:
  * Fixed release metadata for cryptography-vectors
  * Fixed compilation when using LibreSSL 4.0.0.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1730808000">- Avoid using requires_eq, which after the last modifications
  conflicts with python singlespec (order of expansion).</changelog>
  <changelog author="Ben Greiner &lt;code@bnavigator.de&gt;" date="1731067200">- Fix requires_eq replacement for distributions which do not have
  python3-cffi installed (such as SLE15 python module pythons)
  * gh#openSUSE/python-rpm-macros#185
- Remove outdated section in description</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfyhalomacro@opensuse.org&gt;" date="1737892800">- Update to version 44.0.0:
  * BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL &lt; 3.9.
  * Deprecated Python 3.7 support. Python 3.7 is no longer supported by
    the Python core team. Support for Python 3.7 will be removed in a future
    cryptography release.
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.4.0.
  * macOS wheels are now built against the macOS 10.13 SDK. Users on older
    versions of macOS should upgrade, or they will need to build cryptography
    themselves.
  * Enforce the RFC 5280 requirement that extended key usage extensions must not be empty.
  * Added support for timestamp extraction to the :class:`~cryptography.fernet.MultiFernet` class.
  * Relax the Authority Key Identifier requirements on root CA certificates
    during X.509 verification to allow fields permitted by RFC 5280 but
    forbidden by the CA/Browser BRs.
  * Added support for
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2id` when using
    OpenSSL 3.2.0+.
  * Added support for the :class:`~cryptography.x509.Admissions` certificate extension.
  * Added basic support for PKCS7 decryption (including S/MIME 3.2) via
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der`,
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_pem`,
    and :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_smime`.
- Update specfile to accommodate new project structure at version 44.0.0
- Update no-pytest_benchmark.patch</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1740571200">- update to 44.0.1:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.4.1.
  * We now build armv7l manylinux wheels and publish them to
    PyPI.
  * We now build manylinux_2_34 wheels and publish them to PyPI.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1742731200">- update to 44.0.2:
  * We now build wheels for PyPy 3.11.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1746619200">- Update to 44.0.3
  * Fixed compilation when using LibreSSL 4.1.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1752321600">- update to 45.0.5:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.1.
  * Fixed decrypting PKCS#8 files encrypted with SHA1-RC4. (This
    is not considered secure, and is supported only for backwards
    compatibility.)
  * Fixed decrypting PKCS#8 files encrypted with long salts (this
    impacts keys encrypted by Bouncy Castle).
  * Fixed decrypting PKCS#8 files encrypted with DES-CBC-MD5.
    While wildly insecure, this remains prevalent.
  * Fixed using mypy with cryptography on older versions of
    Python.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.0.
  * Support for Python 3.7 is deprecated and will be removed in
    the next cryptography release.
  * Updated the minimum supported Rust version (MSRV) to 1.74.0,
    from 1.65.0.
  * Added support for serialization of PKCS#12 Java truststores
    in :func:`~cryptography.hazmat.primitives.serialization.pkcs1
    2.serialize_java_truststore`
  * Added :meth:`~cryptography.hazmat.primitives.kdf.argon2.Argon
    2id.derive_phc_encoded` and :meth:`~cryptography.hazmat.primi
    tives.kdf.argon2.Argon2id.verify_phc_encoded` methods to
    support password hashing in the PHC string format
  * Added support for PKCS7 decryption and encryption using
    AES-256 as the content algorithm, in addition to AES-128.
  * BACKWARDS INCOMPATIBLE: Made SSH private key loading more
    consistent with other private key loading: :func:`~cryptograp
    hy.hazmat.primitives.serialization.load_ssh_private_key` now
    raises a TypeError if the key is unencrypted but a password
    is provided (previously no exception was raised), and raises
    a TypeError if the key is encrypted but no password is
    provided (previously a ValueError was raised).
  * Added __copy__ to the :class:`~cryptography.hazmat.primitives
    .asymmetric.ec.EllipticCurvePrivateKey`, :class:`~cryptograph
    y.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey`, :c
    lass:`~cryptography.hazmat.primitives.asymmetric.ed25519.Ed25
    519PublicKey`, :class:`~cryptography.hazmat.primitives.asymme
    tric.ed25519.Ed25519PrivateKey`, :class:`~cryptography.hazmat
    .primitives.asymmetric.ed448.Ed448PublicKey`, :class:`~crypto
    graphy.hazmat.primitives.asymmetric.ed448.Ed448PrivateKey`, :
    class:`~cryptography.hazmat.primitives.asymmetric.x25519.X255
    19PublicKey`, :class:`~cryptography.hazmat.primitives.asymmet
    ric.x25519.X25519PrivateKey`, :class:`~cryptography.hazmat.pr
    imitives.asymmetric.x448.X448PublicKey`, :class:`~cryptograph
    y.hazmat.primitives.asymmetric.x448.X448PrivateKey`, :class:`
    ~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey`
    , :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAP
    ublicKey`, :class:`~cryptography.hazmat.primitives.asymmetric
    .dsa.DSAPrivateKey`, :class:`~cryptography.hazmat.primitives.
    asymmetric.dsa.DSAPublicKey`, :class:`~cryptography.hazmat.pr
    imitives.asymmetric.dh.DHPrivateKey`, and :class:`~cryptograp
    hy.hazmat.primitives.asymmetric.dh.DHPublicKey` abstract base
    classes.
  * We significantly refactored how private key loading ( :func:`
    ~cryptography.hazmat.primitives.serialization.load_pem_privat
    e_key` and :func:`~cryptography.hazmat.primitives.serializati
    on.load_der_private_key`) works. This is intended to be
    backwards compatible for all well-formed keys, therefore if
    you discover a key that now raises an exception, please file
    a bug with instructions for reproducing.
  * Added unsafe_skip_rsa_key_validation keyword-argument to :fun
    c:`~cryptography.hazmat.primitives.serialization.load_ssh_pri
    vate_key`.
  * Added :class:`~cryptography.hazmat.primitives.hashes.XOFHash`
    to support repeated :meth:`~cryptography.hazmat.primitives.ha
    shes.XOFHash.squeeze` operations on extendable output
    functions.
  * Added :meth:`~cryptography.x509.ocsp.OCSPResponseBuilder.add_
    response_by_hash` method to allow creating OCSP responses
    using certificate hash values rather than full certificates.
  * Extended the :mod:`X.509 path validation
    &lt;cryptography.x509.verification&gt;` API to support user-
    configured extension policies via the
    :meth:`PolicyBuilder.extension_policies &lt;cryptography.x509.ve
    rification.PolicyBuilder.extension_policies&gt;` method.
  * Deprecated the subject, verification_time and max_chain_depth
    properties on
    :class:`~cryptography.x509.verification.ClientVerifier` and
    :class:`~cryptography.x509.verification.ServerVerifier` in
    favor of a new policy property. These properties will be
    removed in the next release of cryptography.
  * BACKWARDS INCOMPATIBLE: The :meth:`VerifiedClient.subject
    &lt;cryptography.x509.verification.VerifiedClient.subjects&gt;`
    property can now be None since a custom extension policy may
    allow certificates without a Subject Alternative Name
    extension.
  * Changed the behavior when the OpenSSL 3 legacy provider fails
    to load. Instead of raising an exception, a warning is now
    emitted. The CRYPTOGRAPHY_OPENSSL_NO_LEGACY environment
    variable can still be used to disable the legacy provider at
    runtime.
  * Added support for the CRYPTOGRAPHY_BUILD_OPENSSL_NO_LEGACY
    environment variable during build time, which prevents the
    library from ever attempting to load the legacy provider.
  * Added support for the
    :class:`~cryptography.x509.PrivateKeyUsagePeriod` X.509
    extension. This extension defines the period during which the
    private key corresponding to the certificate's public key may
    be used.
  * Added support for compiling against `aws-lc`_.
  * Parsing X.509 structures now more strictly enforces that Name
    structures do not have malformed ASN.1.
  * We now publish py311 wheels that utilize the faster
    pyo3::buffer::PyBuffer interface, resulting in significantly
    improved performance for operations involving small buffers.
  * Added :func:`~cryptography.hazmat.primitives.serialization.ss
    h_key_fingerprint` for computing fingerprints of SSH public
    keys.
  * Added support for deterministic ECDSA signing via the new
    keyword-only argument ecdsa_deterministic in
    :meth:`~cryptography.x509.CertificateBuilder.sign`, :meth:`~c
    ryptography.x509.CertificateRevocationListBuilder.sign` and :
    meth:`~cryptography.x509.CertificateSigningRequestBuilder.sig
    n`.</changelog>
  <changelog author="James Oakley &lt;jfunk@opensuse.org&gt;" date="1756728000">- Add Make-unsafe-subinterpreter-support-available-via-cfg.patch
  to allow ceph-mgr to load modules (boo#1248987)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1757851200">- update to 45.0.7:
  * Added a function to support an upcoming pyOpenSSL release.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1760356800">- update to 46.0.2:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.4.
  * Fixed an issue where users installing via pip on Python 3.14
    development versions would not properly install a dependency.
  * Fixed an issue building the free-threaded macOS 3.14 wheels.
  * BACKWARDS INCOMPATIBLE: Support for Python 3.7 has been
    removed.
  * Support for OpenSSL &lt; 3.0 is deprecated and will be removed
    in the next release.
  * Support for x86_64 macOS (including publishing wheels) is
    deprecated and will be removed in two releases. We will
    switch to publishing an arm64 only wheel for macOS.
  * Support for 32-bit Windows (including publishing wheels) is
    deprecated and will be removed in two releases. Users should
    move to a 64-bit Python installation.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.3.
  * We now build ppc64le manylinux wheels and publish them to
    PyPI.
  * We now build win_arm64 (Windows on Arm) wheels and publish
    them to PyPI.
  * Added support for free-threaded Python 3.14.
  * Removed the deprecated get_attribute_for_oid method on
    :class:`~cryptography.x509.CertificateSigningRequest`. Users
    should use
    :meth:`~cryptography.x509.Attributes.get_attribute_for_oid`
    instead.
  * Removed the deprecated CAST5, SEED, IDEA, and Blowfish
    classes from the cipher module. These are still available in
    :doc:`/hazmat/decrepit/index`.
  * In X.509, when performing a PSS signature with a SHA-3 hash,
    it is now encoded with the official NIST SHA3 OID.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1765195200">- Only require pytest-subtests with pytest &lt; 9.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1770897600">- Update to 46.0.5 (fixes CVE-2026-26007, bsc#1258074)
  * An attacker could create a malicious public key that reveals portions of
    your private key when using certain uncommon elliptic curves (binary
    curves). This version now includes additional security checks to prevent
    this attack. This issue only affects binary elliptic curves, which are
    rarely used in real-world applications. Credit to XlabAI Team of Tencent
    Xuanwu Lab and Atuin Automated Vulnerability Discovery Engine for reporting
    the issue. CVE-2026-26007
  * Support for SECT* binary elliptic curves is deprecated and will be removed
    in the next release.
- Update to 46.0.4
  * Dropped support for win_arm64 wheels.
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.5.
- Update to 46.0.3
  * Fixed compilation when using LibreSSL 4.2.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1774612800">- update to 46.0.6 (CVE-2026-34073, bsc#1260876):
  * SECURITY ISSUE: Fixed a bug where name constraints were not
    applied to peer names during verification when the leaf
    certificate contains a wildcard DNS SAN. Ordinary X.509
    topologies are not affected by this bug, including those used
    by the Web PKI. Credit to Oleh Konko (1seal) for reporting
    the issue. CVE-2026-34073</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1774958400">- Add patch support-maturin-1.12.patch:
  * Correctly deal with maturin bugfix that installs tests and
    docs under sitearch.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1775822400">- Update to 46.0.7 (fixes CVE-2026-39892, bsc#1261863)
  * **SECURITY ISSUE**: Fixed an issue where non-contiguous buffers could be
    passed to APIs that accept Python buffers, which could lead to buffer
    overflow. **CVE-2026-39892**
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.6.
- drop support-maturin-1.12.patch (upstream)
- drop no-pytest_benchmark.patch,
  Make-unsafe-subinterpreter-support-available-via-cfg.patch:
  obsolete</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1777204800">- update to 47.0.0:
  * Support for Python 3.8 is deprecated and will be removed in
    the next cryptography release.
  * BACKWARDS INCOMPATIBLE: Support for binary elliptic curves
    (SECT* classes) has been removed. These curves are rarely
    used and have additional security considerations that make
    them undesirable.
  * BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.1.x has been
    removed. OpenSSL 3.0.0 or later is now required. LibreSSL,
    BoringSSL, and AWS-LC continue to be supported.
  * BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL &lt; 4.1.
  * BACKWARDS INCOMPATIBLE: Loading keys with unsupported
    algorithms or keys with unsupported explicit curve encodings
    now raises
    :class:`~cryptography.exceptions.UnsupportedAlgorithm`
    instead of ValueError. This change affects :func:`~cryptograp
    hy.hazmat.primitives.serialization.load_pem_private_key`, :fu
    nc:`~cryptography.hazmat.primitives.serialization.load_der_pr
    ivate_key`, :func:`~cryptography.hazmat.primitives.serializat
    ion.load_pem_public_key`, :func:`~cryptography.hazmat.primiti
    ves.serialization.load_der_public_key`, and
    :meth:`~cryptography.x509.Certificate.public_key` when called
    on certificates with unsupported public key algorithms.
  * BACKWARDS INCOMPATIBLE: When parsing elliptic curve private
    keys, we now reject keys that incorrectly encode a private
    key of the wrong length because such keys are impossible to
    process in a constant-time manner. We do not believe keys
    with this problem are in wide use, however we may revert this
    change based on the feedback we receive.
  * Deprecated passing 64-bit (8-byte) and 128-bit (16-byte) keys
    to :class:`~cryptography.hazmat.decrepit.ciphers.algorithms.T
    ripleDES`. In a future release, only 192-bit (24-byte) keys
    will be accepted. Users should expand shorter keys themselves
    (e.g., for single DES: key + key + key, for two-key: key +
    key[:8]).
  * Updated the minimum supported Rust version (MSRV) to 1.83.0,
    from 1.74.0.
  * Support for x86_64 macOS (including publishing wheels) is
    deprecated and will be removed in the next release. We will
    switch to publishing an arm64 only wheel for macOS.
  * Support for 32-bit Windows (including publishing wheels) is
    deprecated and will be removed in the next release. Users
    should move to a 64-bit Python installation.
  * public_bytes and private_bytes methods on keys now raise
    TypeError (instead of ValueError) if an invalid encoding is
    provided for the given format.
  * Moved
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.CFB`,
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.OFB`, and
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.CFB8`
    into :doc:`/hazmat/decrepit/index` and deprecated them in the
    modes module. They will be removed from the modes module in
    49.0.0.
  * Moved :class:`~cryptography.hazmat.primitives.ciphers.algorit
    hms.Camellia` into  :doc:`/hazmat/decrepit/index` and
    deprecated it in the cipher module. It will be removed from
    the cipher module in 49.0.0.
  * Added
    :meth:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF.extract`
    to :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF`.
    The previous private implementation will be removed in
    49.0.0.
  * Added support for loading elliptic curve keys that contain
    explicit encodings of the curves secp256r1, secp384r1, and
    secp521r1.
  * Added support for
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2d`
    and
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2i`
    when using OpenSSL 3.2.0+.
  * Added derive_into methods to
    :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF`,
    :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDFExpand`,
    :class:`~cryptography.hazmat.primitives.kdf.concatkdf.ConcatK
    DFHash`, :class:`~cryptography.hazmat.primitives.kdf.concatkd
    f.ConcatKDFHMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2id`,
    :class:`~cryptography.hazmat.primitives.kdf.pbkdf2.PBKDF2HMAC
    `,
    :class:`~cryptography.hazmat.primitives.kdf.kbkdf.KBKDFHMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.kbkdf.KBKDFCMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.scrypt.Scrypt`,
    and
    :class:`~cryptography.hazmat.primitives.kdf.x963kdf.X963KDF`
    to allow deriving keys directly into pre-allocated buffers.
  * Added encrypt_into and decrypt_into methods to
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESCCM`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESGCM`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESGCMSI
    V`, :class:`~cryptography.hazmat.primitives.ciphers.aead.AESO
    CB3`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESSIV`,
    and :class:`~cryptography.hazmat.primitives.ciphers.aead.ChaC
    ha20Poly1305` to allow encrypting directly into a pre-
    allocated buffer.
  * Added support for PKCS1v15 signing without DigestInfo using :
    class:`~cryptography.hazmat.primitives.asymmetric.utils.NoDig
    estInfo`.
  * Added
    :meth:`~cryptography.hazmat.primitives.hashes.Hash.hash`, a
    one-shot method for computing hashes.
  * Added :doc:`/hazmat/primitives/hpke` support implementing RFC
    9180 for hybrid authenticated encryption.
  * Added new :doc:`/hazmat/primitives/asymmetric/mlkem` module
    with support for ML-KEM key encapsulation with AWS-LC and
    BoringSSL. Note: Post-quantum algorithm support requires AWS-
    LC or BoringSSL. As we ship our wheels with OpenSSL, most
    users will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Note: Post-quantum algorithm support requires AWS-LC or
    BoringSSL. As we ship our wheels with OpenSSL, most users
    will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Added new :doc:`/hazmat/primitives/asymmetric/mldsa` module
    with support for ML-DSA signing and verification with AWS-LC
    and BoringSSL. Note: Post-quantum algorithm support requires
    AWS-LC or BoringSSL. As we ship our wheels with OpenSSL, most
    users will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Note: Post-quantum algorithm support requires AWS-LC or
    BoringSSL. As we ship our wheels with OpenSSL, most users
    will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Added new :doc:`/hazmat/asn1/index` module with support for
    declaratively defining custom ASN.1 types and
    encoding/decoding them.
  * Fixed compilation when using LibreSSL 4.3.0 and OpenSSL
    4.0.0.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 4.0.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1778414400">- update to 48.0.0:
  * BACKWARDS INCOMPATIBLE: Support for Python 3.8 has been
    removed. cryptography now requires Python 3.9 or later.
  * BACKWARDS INCOMPATIBLE: Loading an X.509 CRL whose inner
    TBSCertList.signature algorithm does not match the outer
    signatureAlgorithm now raises ValueError. Previously, such
    CRLs were parsed successfully and only rejected during
    signature validation.
  * Added support for :doc:`/hazmat/primitives/asymmetric/mlkem`
    and :doc:`/hazmat/primitives/asymmetric/mldsa` when using
    OpenSSL 3.5.0 or later, in addition to the existing AWS-LC
    and BoringSSL support. This means post-quantum algorithms are
    now available to users of our wheels. Note: Going forward, we
    do not guarantee that all functionality in cryptography will
    be available when building against OpenSSL. See
    :doc:`/statements/state-of-openssl` for more information.
  * Note: Going forward, we do not guarantee that all
    functionality in cryptography will be available when building
    against OpenSSL. See :doc:`/statements/state-of-openssl` for
    more information.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1781438400">- update to 49.0.0:
  * BACKWARDS INCOMPATIBLE: Removed the deprecated
    PUBLIC_KEY_TYPES, PRIVATE_KEY_TYPES,
    CERTIFICATE_PRIVATE_KEY_TYPES,
    CERTIFICATE_ISSUER_PUBLIC_KEY_TYPES, and
    CERTIFICATE_PUBLIC_KEY_TYPES type aliases. Use
    PublicKeyTypes, PrivateKeyTypes,
    CertificateIssuerPrivateKeyTypes,
    CertificateIssuerPublicKeyTypes, and
    CertificatePublicKeyTypes instead. These were deprecated in
    version 40.0.
  * BACKWARDS INCOMPATIBLE: :class:`~cryptography.hazmat.primitiv
    es.ciphers.algorithms.ChaCha20` now treats the first 4 bytes
    of the nonce as a 32-bit little-endian block counter (as
    defined in RFC 7539) and tracks the number of bytes
    processed. Attempting to encrypt or decrypt more data than
    the counter allows before it would overflow now raises a
    :class:`ValueError` rather than silently diverging from RFC
    7539. Setting the counter portion of the nonce to zero allows
    encrypting up to 256 GiB with a given nonce.
  * BACKWARDS INCOMPATIBLE: Loading an X.509 certificate whose
    ECDSA or DSA signature AlgorithmIdentifier contains encoded
    NULL parameters now raises a :class:`ValueError`. Such
    certificates are invalid, but older versions of Java emitted
    them; previously they loaded with a deprecation warning.
  * Fixed cross-compilation of the CFFI bindings when
    PYO3_CROSS_LIB_DIR is set. The build now derives the Python
    include directory from PYO3_CROSS_LIB_DIR instead of querying
    the host interpreter, which previously caused the build to
    fail during cross-compilations for embedded systems, on hosts
    which have same-version Python development headers installed
    as the target Python.
  * Added support for signing and verifying X.509 certificates,
    certificate signing requests, and certificate revocation
    lists with :doc:`/hazmat/primitives/asymmetric/mldsa` keys,
    as well as loading certificates that contain ML-DSA public
    keys.
  * Added
    :meth:`~cryptography.hazmat.primitives.hpke.KEM.enc_length`
    to :class:`~cryptography.hazmat.primitives.hpke.KEM` so
    callers can split the encapsulated key from the ciphertext
    returned by
    :meth:`~cryptography.hazmat.primitives.hpke.Suite.encrypt`.
  * :meth:`~cryptography.x509.verification.ExtensionPolicy.requir
    e_present`, :meth:`~cryptography.x509.verification.ExtensionP
    olicy.may_be_present`, and :meth:`~cryptography.x509.verifica
    tion.ExtensionPolicy.require_not_present` now accept any
    extension type. Previously only a fixed set of extension
    types was supported, which made it impossible to account for
    otherwise unrecognized critical extensions during path
    validation.
  * Added support for using
    :class:`~cryptography.x509.Certificate`,
    :class:`~cryptography.x509.CertificateSigningRequest`, and
    :class:`~cryptography.x509.CertificateRevocationList` as
    field types in :doc:`/hazmat/asn1/index` structures.
  * Added :func:`~cryptography.hazmat.asn1.value_set`, a class
    decorator that registers an :class:`enum.Enum` subclass as an
    ASN.1 value set: members are encoded as their underlying
    value, and decoding fails if the decoded value does not match
    one of the declared members.
  * Added :meth:`~cryptography.x509.Name.from_bytes` for parsing
    a :class:`~cryptography.x509.Name` from DER bytes, the
    inverse of :meth:`~cryptography.x509.Name.public_bytes`.
  * Added the rsa_padding keyword-only parameter to
    :meth:`~cryptography.x509.CertificateBuilder.public_key`.
    Passing the :class:`~cryptography.hazmat.primitives.asymmetri
    c.padding.PSS` class (not an instance) encodes an RSA subject
    public key in the certificate's subjectPublicKeyInfo with the
    id-RSASSA-PSS OID and no parameters.
  * Added external mu (message representative) support to
    :doc:`/hazmat/primitives/asymmetric/mldsa` via the sign_mu
    and verify_mu methods, which sign and verify a precomputed
    64-byte mu as defined in FIPS 204.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 4.0.1.</changelog>
</package>
<package pkgid="dda4ccf3ae2a4c6fec28811ffba45bc17fe1753b2e76473f923c1d7abe1ad5bc2dd1d058aabc8abe273513d40edd112c116713c0f9fb84f0952bf9e5823bdacf" name="python313-cryptography" arch="x86_64">
  <version epoch="0" ver="49.0.0" rel="289.3"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1727524800">- update to 43.0.1:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.3.2.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1729598400">- update to 43.0.3:
  * Fixed release metadata for cryptography-vectors
  * Fixed compilation when using LibreSSL 4.0.0.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1730808000">- Avoid using requires_eq, which after the last modifications
  conflicts with python singlespec (order of expansion).</changelog>
  <changelog author="Ben Greiner &lt;code@bnavigator.de&gt;" date="1731067200">- Fix requires_eq replacement for distributions which do not have
  python3-cffi installed (such as SLE15 python module pythons)
  * gh#openSUSE/python-rpm-macros#185
- Remove outdated section in description</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfyhalomacro@opensuse.org&gt;" date="1737892800">- Update to version 44.0.0:
  * BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL &lt; 3.9.
  * Deprecated Python 3.7 support. Python 3.7 is no longer supported by
    the Python core team. Support for Python 3.7 will be removed in a future
    cryptography release.
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.4.0.
  * macOS wheels are now built against the macOS 10.13 SDK. Users on older
    versions of macOS should upgrade, or they will need to build cryptography
    themselves.
  * Enforce the RFC 5280 requirement that extended key usage extensions must not be empty.
  * Added support for timestamp extraction to the :class:`~cryptography.fernet.MultiFernet` class.
  * Relax the Authority Key Identifier requirements on root CA certificates
    during X.509 verification to allow fields permitted by RFC 5280 but
    forbidden by the CA/Browser BRs.
  * Added support for
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2id` when using
    OpenSSL 3.2.0+.
  * Added support for the :class:`~cryptography.x509.Admissions` certificate extension.
  * Added basic support for PKCS7 decryption (including S/MIME 3.2) via
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der`,
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_pem`,
    and :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_smime`.
- Update specfile to accommodate new project structure at version 44.0.0
- Update no-pytest_benchmark.patch</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1740571200">- update to 44.0.1:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.4.1.
  * We now build armv7l manylinux wheels and publish them to
    PyPI.
  * We now build manylinux_2_34 wheels and publish them to PyPI.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1742731200">- update to 44.0.2:
  * We now build wheels for PyPy 3.11.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1746619200">- Update to 44.0.3
  * Fixed compilation when using LibreSSL 4.1.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1752321600">- update to 45.0.5:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.1.
  * Fixed decrypting PKCS#8 files encrypted with SHA1-RC4. (This
    is not considered secure, and is supported only for backwards
    compatibility.)
  * Fixed decrypting PKCS#8 files encrypted with long salts (this
    impacts keys encrypted by Bouncy Castle).
  * Fixed decrypting PKCS#8 files encrypted with DES-CBC-MD5.
    While wildly insecure, this remains prevalent.
  * Fixed using mypy with cryptography on older versions of
    Python.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.0.
  * Support for Python 3.7 is deprecated and will be removed in
    the next cryptography release.
  * Updated the minimum supported Rust version (MSRV) to 1.74.0,
    from 1.65.0.
  * Added support for serialization of PKCS#12 Java truststores
    in :func:`~cryptography.hazmat.primitives.serialization.pkcs1
    2.serialize_java_truststore`
  * Added :meth:`~cryptography.hazmat.primitives.kdf.argon2.Argon
    2id.derive_phc_encoded` and :meth:`~cryptography.hazmat.primi
    tives.kdf.argon2.Argon2id.verify_phc_encoded` methods to
    support password hashing in the PHC string format
  * Added support for PKCS7 decryption and encryption using
    AES-256 as the content algorithm, in addition to AES-128.
  * BACKWARDS INCOMPATIBLE: Made SSH private key loading more
    consistent with other private key loading: :func:`~cryptograp
    hy.hazmat.primitives.serialization.load_ssh_private_key` now
    raises a TypeError if the key is unencrypted but a password
    is provided (previously no exception was raised), and raises
    a TypeError if the key is encrypted but no password is
    provided (previously a ValueError was raised).
  * Added __copy__ to the :class:`~cryptography.hazmat.primitives
    .asymmetric.ec.EllipticCurvePrivateKey`, :class:`~cryptograph
    y.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey`, :c
    lass:`~cryptography.hazmat.primitives.asymmetric.ed25519.Ed25
    519PublicKey`, :class:`~cryptography.hazmat.primitives.asymme
    tric.ed25519.Ed25519PrivateKey`, :class:`~cryptography.hazmat
    .primitives.asymmetric.ed448.Ed448PublicKey`, :class:`~crypto
    graphy.hazmat.primitives.asymmetric.ed448.Ed448PrivateKey`, :
    class:`~cryptography.hazmat.primitives.asymmetric.x25519.X255
    19PublicKey`, :class:`~cryptography.hazmat.primitives.asymmet
    ric.x25519.X25519PrivateKey`, :class:`~cryptography.hazmat.pr
    imitives.asymmetric.x448.X448PublicKey`, :class:`~cryptograph
    y.hazmat.primitives.asymmetric.x448.X448PrivateKey`, :class:`
    ~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey`
    , :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAP
    ublicKey`, :class:`~cryptography.hazmat.primitives.asymmetric
    .dsa.DSAPrivateKey`, :class:`~cryptography.hazmat.primitives.
    asymmetric.dsa.DSAPublicKey`, :class:`~cryptography.hazmat.pr
    imitives.asymmetric.dh.DHPrivateKey`, and :class:`~cryptograp
    hy.hazmat.primitives.asymmetric.dh.DHPublicKey` abstract base
    classes.
  * We significantly refactored how private key loading ( :func:`
    ~cryptography.hazmat.primitives.serialization.load_pem_privat
    e_key` and :func:`~cryptography.hazmat.primitives.serializati
    on.load_der_private_key`) works. This is intended to be
    backwards compatible for all well-formed keys, therefore if
    you discover a key that now raises an exception, please file
    a bug with instructions for reproducing.
  * Added unsafe_skip_rsa_key_validation keyword-argument to :fun
    c:`~cryptography.hazmat.primitives.serialization.load_ssh_pri
    vate_key`.
  * Added :class:`~cryptography.hazmat.primitives.hashes.XOFHash`
    to support repeated :meth:`~cryptography.hazmat.primitives.ha
    shes.XOFHash.squeeze` operations on extendable output
    functions.
  * Added :meth:`~cryptography.x509.ocsp.OCSPResponseBuilder.add_
    response_by_hash` method to allow creating OCSP responses
    using certificate hash values rather than full certificates.
  * Extended the :mod:`X.509 path validation
    &lt;cryptography.x509.verification&gt;` API to support user-
    configured extension policies via the
    :meth:`PolicyBuilder.extension_policies &lt;cryptography.x509.ve
    rification.PolicyBuilder.extension_policies&gt;` method.
  * Deprecated the subject, verification_time and max_chain_depth
    properties on
    :class:`~cryptography.x509.verification.ClientVerifier` and
    :class:`~cryptography.x509.verification.ServerVerifier` in
    favor of a new policy property. These properties will be
    removed in the next release of cryptography.
  * BACKWARDS INCOMPATIBLE: The :meth:`VerifiedClient.subject
    &lt;cryptography.x509.verification.VerifiedClient.subjects&gt;`
    property can now be None since a custom extension policy may
    allow certificates without a Subject Alternative Name
    extension.
  * Changed the behavior when the OpenSSL 3 legacy provider fails
    to load. Instead of raising an exception, a warning is now
    emitted. The CRYPTOGRAPHY_OPENSSL_NO_LEGACY environment
    variable can still be used to disable the legacy provider at
    runtime.
  * Added support for the CRYPTOGRAPHY_BUILD_OPENSSL_NO_LEGACY
    environment variable during build time, which prevents the
    library from ever attempting to load the legacy provider.
  * Added support for the
    :class:`~cryptography.x509.PrivateKeyUsagePeriod` X.509
    extension. This extension defines the period during which the
    private key corresponding to the certificate's public key may
    be used.
  * Added support for compiling against `aws-lc`_.
  * Parsing X.509 structures now more strictly enforces that Name
    structures do not have malformed ASN.1.
  * We now publish py311 wheels that utilize the faster
    pyo3::buffer::PyBuffer interface, resulting in significantly
    improved performance for operations involving small buffers.
  * Added :func:`~cryptography.hazmat.primitives.serialization.ss
    h_key_fingerprint` for computing fingerprints of SSH public
    keys.
  * Added support for deterministic ECDSA signing via the new
    keyword-only argument ecdsa_deterministic in
    :meth:`~cryptography.x509.CertificateBuilder.sign`, :meth:`~c
    ryptography.x509.CertificateRevocationListBuilder.sign` and :
    meth:`~cryptography.x509.CertificateSigningRequestBuilder.sig
    n`.</changelog>
  <changelog author="James Oakley &lt;jfunk@opensuse.org&gt;" date="1756728000">- Add Make-unsafe-subinterpreter-support-available-via-cfg.patch
  to allow ceph-mgr to load modules (boo#1248987)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1757851200">- update to 45.0.7:
  * Added a function to support an upcoming pyOpenSSL release.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1760356800">- update to 46.0.2:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.4.
  * Fixed an issue where users installing via pip on Python 3.14
    development versions would not properly install a dependency.
  * Fixed an issue building the free-threaded macOS 3.14 wheels.
  * BACKWARDS INCOMPATIBLE: Support for Python 3.7 has been
    removed.
  * Support for OpenSSL &lt; 3.0 is deprecated and will be removed
    in the next release.
  * Support for x86_64 macOS (including publishing wheels) is
    deprecated and will be removed in two releases. We will
    switch to publishing an arm64 only wheel for macOS.
  * Support for 32-bit Windows (including publishing wheels) is
    deprecated and will be removed in two releases. Users should
    move to a 64-bit Python installation.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.3.
  * We now build ppc64le manylinux wheels and publish them to
    PyPI.
  * We now build win_arm64 (Windows on Arm) wheels and publish
    them to PyPI.
  * Added support for free-threaded Python 3.14.
  * Removed the deprecated get_attribute_for_oid method on
    :class:`~cryptography.x509.CertificateSigningRequest`. Users
    should use
    :meth:`~cryptography.x509.Attributes.get_attribute_for_oid`
    instead.
  * Removed the deprecated CAST5, SEED, IDEA, and Blowfish
    classes from the cipher module. These are still available in
    :doc:`/hazmat/decrepit/index`.
  * In X.509, when performing a PSS signature with a SHA-3 hash,
    it is now encoded with the official NIST SHA3 OID.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1765195200">- Only require pytest-subtests with pytest &lt; 9.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1770897600">- Update to 46.0.5 (fixes CVE-2026-26007, bsc#1258074)
  * An attacker could create a malicious public key that reveals portions of
    your private key when using certain uncommon elliptic curves (binary
    curves). This version now includes additional security checks to prevent
    this attack. This issue only affects binary elliptic curves, which are
    rarely used in real-world applications. Credit to XlabAI Team of Tencent
    Xuanwu Lab and Atuin Automated Vulnerability Discovery Engine for reporting
    the issue. CVE-2026-26007
  * Support for SECT* binary elliptic curves is deprecated and will be removed
    in the next release.
- Update to 46.0.4
  * Dropped support for win_arm64 wheels.
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.5.
- Update to 46.0.3
  * Fixed compilation when using LibreSSL 4.2.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1774612800">- update to 46.0.6 (CVE-2026-34073, bsc#1260876):
  * SECURITY ISSUE: Fixed a bug where name constraints were not
    applied to peer names during verification when the leaf
    certificate contains a wildcard DNS SAN. Ordinary X.509
    topologies are not affected by this bug, including those used
    by the Web PKI. Credit to Oleh Konko (1seal) for reporting
    the issue. CVE-2026-34073</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1774958400">- Add patch support-maturin-1.12.patch:
  * Correctly deal with maturin bugfix that installs tests and
    docs under sitearch.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1775822400">- Update to 46.0.7 (fixes CVE-2026-39892, bsc#1261863)
  * **SECURITY ISSUE**: Fixed an issue where non-contiguous buffers could be
    passed to APIs that accept Python buffers, which could lead to buffer
    overflow. **CVE-2026-39892**
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.6.
- drop support-maturin-1.12.patch (upstream)
- drop no-pytest_benchmark.patch,
  Make-unsafe-subinterpreter-support-available-via-cfg.patch:
  obsolete</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1777204800">- update to 47.0.0:
  * Support for Python 3.8 is deprecated and will be removed in
    the next cryptography release.
  * BACKWARDS INCOMPATIBLE: Support for binary elliptic curves
    (SECT* classes) has been removed. These curves are rarely
    used and have additional security considerations that make
    them undesirable.
  * BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.1.x has been
    removed. OpenSSL 3.0.0 or later is now required. LibreSSL,
    BoringSSL, and AWS-LC continue to be supported.
  * BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL &lt; 4.1.
  * BACKWARDS INCOMPATIBLE: Loading keys with unsupported
    algorithms or keys with unsupported explicit curve encodings
    now raises
    :class:`~cryptography.exceptions.UnsupportedAlgorithm`
    instead of ValueError. This change affects :func:`~cryptograp
    hy.hazmat.primitives.serialization.load_pem_private_key`, :fu
    nc:`~cryptography.hazmat.primitives.serialization.load_der_pr
    ivate_key`, :func:`~cryptography.hazmat.primitives.serializat
    ion.load_pem_public_key`, :func:`~cryptography.hazmat.primiti
    ves.serialization.load_der_public_key`, and
    :meth:`~cryptography.x509.Certificate.public_key` when called
    on certificates with unsupported public key algorithms.
  * BACKWARDS INCOMPATIBLE: When parsing elliptic curve private
    keys, we now reject keys that incorrectly encode a private
    key of the wrong length because such keys are impossible to
    process in a constant-time manner. We do not believe keys
    with this problem are in wide use, however we may revert this
    change based on the feedback we receive.
  * Deprecated passing 64-bit (8-byte) and 128-bit (16-byte) keys
    to :class:`~cryptography.hazmat.decrepit.ciphers.algorithms.T
    ripleDES`. In a future release, only 192-bit (24-byte) keys
    will be accepted. Users should expand shorter keys themselves
    (e.g., for single DES: key + key + key, for two-key: key +
    key[:8]).
  * Updated the minimum supported Rust version (MSRV) to 1.83.0,
    from 1.74.0.
  * Support for x86_64 macOS (including publishing wheels) is
    deprecated and will be removed in the next release. We will
    switch to publishing an arm64 only wheel for macOS.
  * Support for 32-bit Windows (including publishing wheels) is
    deprecated and will be removed in the next release. Users
    should move to a 64-bit Python installation.
  * public_bytes and private_bytes methods on keys now raise
    TypeError (instead of ValueError) if an invalid encoding is
    provided for the given format.
  * Moved
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.CFB`,
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.OFB`, and
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.CFB8`
    into :doc:`/hazmat/decrepit/index` and deprecated them in the
    modes module. They will be removed from the modes module in
    49.0.0.
  * Moved :class:`~cryptography.hazmat.primitives.ciphers.algorit
    hms.Camellia` into  :doc:`/hazmat/decrepit/index` and
    deprecated it in the cipher module. It will be removed from
    the cipher module in 49.0.0.
  * Added
    :meth:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF.extract`
    to :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF`.
    The previous private implementation will be removed in
    49.0.0.
  * Added support for loading elliptic curve keys that contain
    explicit encodings of the curves secp256r1, secp384r1, and
    secp521r1.
  * Added support for
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2d`
    and
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2i`
    when using OpenSSL 3.2.0+.
  * Added derive_into methods to
    :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF`,
    :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDFExpand`,
    :class:`~cryptography.hazmat.primitives.kdf.concatkdf.ConcatK
    DFHash`, :class:`~cryptography.hazmat.primitives.kdf.concatkd
    f.ConcatKDFHMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2id`,
    :class:`~cryptography.hazmat.primitives.kdf.pbkdf2.PBKDF2HMAC
    `,
    :class:`~cryptography.hazmat.primitives.kdf.kbkdf.KBKDFHMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.kbkdf.KBKDFCMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.scrypt.Scrypt`,
    and
    :class:`~cryptography.hazmat.primitives.kdf.x963kdf.X963KDF`
    to allow deriving keys directly into pre-allocated buffers.
  * Added encrypt_into and decrypt_into methods to
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESCCM`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESGCM`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESGCMSI
    V`, :class:`~cryptography.hazmat.primitives.ciphers.aead.AESO
    CB3`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESSIV`,
    and :class:`~cryptography.hazmat.primitives.ciphers.aead.ChaC
    ha20Poly1305` to allow encrypting directly into a pre-
    allocated buffer.
  * Added support for PKCS1v15 signing without DigestInfo using :
    class:`~cryptography.hazmat.primitives.asymmetric.utils.NoDig
    estInfo`.
  * Added
    :meth:`~cryptography.hazmat.primitives.hashes.Hash.hash`, a
    one-shot method for computing hashes.
  * Added :doc:`/hazmat/primitives/hpke` support implementing RFC
    9180 for hybrid authenticated encryption.
  * Added new :doc:`/hazmat/primitives/asymmetric/mlkem` module
    with support for ML-KEM key encapsulation with AWS-LC and
    BoringSSL. Note: Post-quantum algorithm support requires AWS-
    LC or BoringSSL. As we ship our wheels with OpenSSL, most
    users will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Note: Post-quantum algorithm support requires AWS-LC or
    BoringSSL. As we ship our wheels with OpenSSL, most users
    will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Added new :doc:`/hazmat/primitives/asymmetric/mldsa` module
    with support for ML-DSA signing and verification with AWS-LC
    and BoringSSL. Note: Post-quantum algorithm support requires
    AWS-LC or BoringSSL. As we ship our wheels with OpenSSL, most
    users will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Note: Post-quantum algorithm support requires AWS-LC or
    BoringSSL. As we ship our wheels with OpenSSL, most users
    will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Added new :doc:`/hazmat/asn1/index` module with support for
    declaratively defining custom ASN.1 types and
    encoding/decoding them.
  * Fixed compilation when using LibreSSL 4.3.0 and OpenSSL
    4.0.0.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 4.0.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1778414400">- update to 48.0.0:
  * BACKWARDS INCOMPATIBLE: Support for Python 3.8 has been
    removed. cryptography now requires Python 3.9 or later.
  * BACKWARDS INCOMPATIBLE: Loading an X.509 CRL whose inner
    TBSCertList.signature algorithm does not match the outer
    signatureAlgorithm now raises ValueError. Previously, such
    CRLs were parsed successfully and only rejected during
    signature validation.
  * Added support for :doc:`/hazmat/primitives/asymmetric/mlkem`
    and :doc:`/hazmat/primitives/asymmetric/mldsa` when using
    OpenSSL 3.5.0 or later, in addition to the existing AWS-LC
    and BoringSSL support. This means post-quantum algorithms are
    now available to users of our wheels. Note: Going forward, we
    do not guarantee that all functionality in cryptography will
    be available when building against OpenSSL. See
    :doc:`/statements/state-of-openssl` for more information.
  * Note: Going forward, we do not guarantee that all
    functionality in cryptography will be available when building
    against OpenSSL. See :doc:`/statements/state-of-openssl` for
    more information.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1781438400">- update to 49.0.0:
  * BACKWARDS INCOMPATIBLE: Removed the deprecated
    PUBLIC_KEY_TYPES, PRIVATE_KEY_TYPES,
    CERTIFICATE_PRIVATE_KEY_TYPES,
    CERTIFICATE_ISSUER_PUBLIC_KEY_TYPES, and
    CERTIFICATE_PUBLIC_KEY_TYPES type aliases. Use
    PublicKeyTypes, PrivateKeyTypes,
    CertificateIssuerPrivateKeyTypes,
    CertificateIssuerPublicKeyTypes, and
    CertificatePublicKeyTypes instead. These were deprecated in
    version 40.0.
  * BACKWARDS INCOMPATIBLE: :class:`~cryptography.hazmat.primitiv
    es.ciphers.algorithms.ChaCha20` now treats the first 4 bytes
    of the nonce as a 32-bit little-endian block counter (as
    defined in RFC 7539) and tracks the number of bytes
    processed. Attempting to encrypt or decrypt more data than
    the counter allows before it would overflow now raises a
    :class:`ValueError` rather than silently diverging from RFC
    7539. Setting the counter portion of the nonce to zero allows
    encrypting up to 256 GiB with a given nonce.
  * BACKWARDS INCOMPATIBLE: Loading an X.509 certificate whose
    ECDSA or DSA signature AlgorithmIdentifier contains encoded
    NULL parameters now raises a :class:`ValueError`. Such
    certificates are invalid, but older versions of Java emitted
    them; previously they loaded with a deprecation warning.
  * Fixed cross-compilation of the CFFI bindings when
    PYO3_CROSS_LIB_DIR is set. The build now derives the Python
    include directory from PYO3_CROSS_LIB_DIR instead of querying
    the host interpreter, which previously caused the build to
    fail during cross-compilations for embedded systems, on hosts
    which have same-version Python development headers installed
    as the target Python.
  * Added support for signing and verifying X.509 certificates,
    certificate signing requests, and certificate revocation
    lists with :doc:`/hazmat/primitives/asymmetric/mldsa` keys,
    as well as loading certificates that contain ML-DSA public
    keys.
  * Added
    :meth:`~cryptography.hazmat.primitives.hpke.KEM.enc_length`
    to :class:`~cryptography.hazmat.primitives.hpke.KEM` so
    callers can split the encapsulated key from the ciphertext
    returned by
    :meth:`~cryptography.hazmat.primitives.hpke.Suite.encrypt`.
  * :meth:`~cryptography.x509.verification.ExtensionPolicy.requir
    e_present`, :meth:`~cryptography.x509.verification.ExtensionP
    olicy.may_be_present`, and :meth:`~cryptography.x509.verifica
    tion.ExtensionPolicy.require_not_present` now accept any
    extension type. Previously only a fixed set of extension
    types was supported, which made it impossible to account for
    otherwise unrecognized critical extensions during path
    validation.
  * Added support for using
    :class:`~cryptography.x509.Certificate`,
    :class:`~cryptography.x509.CertificateSigningRequest`, and
    :class:`~cryptography.x509.CertificateRevocationList` as
    field types in :doc:`/hazmat/asn1/index` structures.
  * Added :func:`~cryptography.hazmat.asn1.value_set`, a class
    decorator that registers an :class:`enum.Enum` subclass as an
    ASN.1 value set: members are encoded as their underlying
    value, and decoding fails if the decoded value does not match
    one of the declared members.
  * Added :meth:`~cryptography.x509.Name.from_bytes` for parsing
    a :class:`~cryptography.x509.Name` from DER bytes, the
    inverse of :meth:`~cryptography.x509.Name.public_bytes`.
  * Added the rsa_padding keyword-only parameter to
    :meth:`~cryptography.x509.CertificateBuilder.public_key`.
    Passing the :class:`~cryptography.hazmat.primitives.asymmetri
    c.padding.PSS` class (not an instance) encodes an RSA subject
    public key in the certificate's subjectPublicKeyInfo with the
    id-RSASSA-PSS OID and no parameters.
  * Added external mu (message representative) support to
    :doc:`/hazmat/primitives/asymmetric/mldsa` via the sign_mu
    and verify_mu methods, which sign and verify a precomputed
    64-byte mu as defined in FIPS 204.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 4.0.1.</changelog>
</package>
<package pkgid="be63950cc4916ce9efa6dc016a4d354e2734188b05f037960d095a01d63932afe00a64fbe12ebb8203e99c7e0af1bc941790d3e9086f8787c3ce87ae16ca337a" name="python313-cryptography-debuginfo" arch="aarch64">
  <version epoch="0" ver="49.0.0" rel="289.3"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1727524800">- update to 43.0.1:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.3.2.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1729598400">- update to 43.0.3:
  * Fixed release metadata for cryptography-vectors
  * Fixed compilation when using LibreSSL 4.0.0.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1730808000">- Avoid using requires_eq, which after the last modifications
  conflicts with python singlespec (order of expansion).</changelog>
  <changelog author="Ben Greiner &lt;code@bnavigator.de&gt;" date="1731067200">- Fix requires_eq replacement for distributions which do not have
  python3-cffi installed (such as SLE15 python module pythons)
  * gh#openSUSE/python-rpm-macros#185
- Remove outdated section in description</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfyhalomacro@opensuse.org&gt;" date="1737892800">- Update to version 44.0.0:
  * BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL &lt; 3.9.
  * Deprecated Python 3.7 support. Python 3.7 is no longer supported by
    the Python core team. Support for Python 3.7 will be removed in a future
    cryptography release.
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.4.0.
  * macOS wheels are now built against the macOS 10.13 SDK. Users on older
    versions of macOS should upgrade, or they will need to build cryptography
    themselves.
  * Enforce the RFC 5280 requirement that extended key usage extensions must not be empty.
  * Added support for timestamp extraction to the :class:`~cryptography.fernet.MultiFernet` class.
  * Relax the Authority Key Identifier requirements on root CA certificates
    during X.509 verification to allow fields permitted by RFC 5280 but
    forbidden by the CA/Browser BRs.
  * Added support for
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2id` when using
    OpenSSL 3.2.0+.
  * Added support for the :class:`~cryptography.x509.Admissions` certificate extension.
  * Added basic support for PKCS7 decryption (including S/MIME 3.2) via
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der`,
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_pem`,
    and :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_smime`.
- Update specfile to accommodate new project structure at version 44.0.0
- Update no-pytest_benchmark.patch</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1740571200">- update to 44.0.1:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.4.1.
  * We now build armv7l manylinux wheels and publish them to
    PyPI.
  * We now build manylinux_2_34 wheels and publish them to PyPI.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1742731200">- update to 44.0.2:
  * We now build wheels for PyPy 3.11.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1746619200">- Update to 44.0.3
  * Fixed compilation when using LibreSSL 4.1.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1752321600">- update to 45.0.5:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.1.
  * Fixed decrypting PKCS#8 files encrypted with SHA1-RC4. (This
    is not considered secure, and is supported only for backwards
    compatibility.)
  * Fixed decrypting PKCS#8 files encrypted with long salts (this
    impacts keys encrypted by Bouncy Castle).
  * Fixed decrypting PKCS#8 files encrypted with DES-CBC-MD5.
    While wildly insecure, this remains prevalent.
  * Fixed using mypy with cryptography on older versions of
    Python.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.0.
  * Support for Python 3.7 is deprecated and will be removed in
    the next cryptography release.
  * Updated the minimum supported Rust version (MSRV) to 1.74.0,
    from 1.65.0.
  * Added support for serialization of PKCS#12 Java truststores
    in :func:`~cryptography.hazmat.primitives.serialization.pkcs1
    2.serialize_java_truststore`
  * Added :meth:`~cryptography.hazmat.primitives.kdf.argon2.Argon
    2id.derive_phc_encoded` and :meth:`~cryptography.hazmat.primi
    tives.kdf.argon2.Argon2id.verify_phc_encoded` methods to
    support password hashing in the PHC string format
  * Added support for PKCS7 decryption and encryption using
    AES-256 as the content algorithm, in addition to AES-128.
  * BACKWARDS INCOMPATIBLE: Made SSH private key loading more
    consistent with other private key loading: :func:`~cryptograp
    hy.hazmat.primitives.serialization.load_ssh_private_key` now
    raises a TypeError if the key is unencrypted but a password
    is provided (previously no exception was raised), and raises
    a TypeError if the key is encrypted but no password is
    provided (previously a ValueError was raised).
  * Added __copy__ to the :class:`~cryptography.hazmat.primitives
    .asymmetric.ec.EllipticCurvePrivateKey`, :class:`~cryptograph
    y.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey`, :c
    lass:`~cryptography.hazmat.primitives.asymmetric.ed25519.Ed25
    519PublicKey`, :class:`~cryptography.hazmat.primitives.asymme
    tric.ed25519.Ed25519PrivateKey`, :class:`~cryptography.hazmat
    .primitives.asymmetric.ed448.Ed448PublicKey`, :class:`~crypto
    graphy.hazmat.primitives.asymmetric.ed448.Ed448PrivateKey`, :
    class:`~cryptography.hazmat.primitives.asymmetric.x25519.X255
    19PublicKey`, :class:`~cryptography.hazmat.primitives.asymmet
    ric.x25519.X25519PrivateKey`, :class:`~cryptography.hazmat.pr
    imitives.asymmetric.x448.X448PublicKey`, :class:`~cryptograph
    y.hazmat.primitives.asymmetric.x448.X448PrivateKey`, :class:`
    ~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey`
    , :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAP
    ublicKey`, :class:`~cryptography.hazmat.primitives.asymmetric
    .dsa.DSAPrivateKey`, :class:`~cryptography.hazmat.primitives.
    asymmetric.dsa.DSAPublicKey`, :class:`~cryptography.hazmat.pr
    imitives.asymmetric.dh.DHPrivateKey`, and :class:`~cryptograp
    hy.hazmat.primitives.asymmetric.dh.DHPublicKey` abstract base
    classes.
  * We significantly refactored how private key loading ( :func:`
    ~cryptography.hazmat.primitives.serialization.load_pem_privat
    e_key` and :func:`~cryptography.hazmat.primitives.serializati
    on.load_der_private_key`) works. This is intended to be
    backwards compatible for all well-formed keys, therefore if
    you discover a key that now raises an exception, please file
    a bug with instructions for reproducing.
  * Added unsafe_skip_rsa_key_validation keyword-argument to :fun
    c:`~cryptography.hazmat.primitives.serialization.load_ssh_pri
    vate_key`.
  * Added :class:`~cryptography.hazmat.primitives.hashes.XOFHash`
    to support repeated :meth:`~cryptography.hazmat.primitives.ha
    shes.XOFHash.squeeze` operations on extendable output
    functions.
  * Added :meth:`~cryptography.x509.ocsp.OCSPResponseBuilder.add_
    response_by_hash` method to allow creating OCSP responses
    using certificate hash values rather than full certificates.
  * Extended the :mod:`X.509 path validation
    &lt;cryptography.x509.verification&gt;` API to support user-
    configured extension policies via the
    :meth:`PolicyBuilder.extension_policies &lt;cryptography.x509.ve
    rification.PolicyBuilder.extension_policies&gt;` method.
  * Deprecated the subject, verification_time and max_chain_depth
    properties on
    :class:`~cryptography.x509.verification.ClientVerifier` and
    :class:`~cryptography.x509.verification.ServerVerifier` in
    favor of a new policy property. These properties will be
    removed in the next release of cryptography.
  * BACKWARDS INCOMPATIBLE: The :meth:`VerifiedClient.subject
    &lt;cryptography.x509.verification.VerifiedClient.subjects&gt;`
    property can now be None since a custom extension policy may
    allow certificates without a Subject Alternative Name
    extension.
  * Changed the behavior when the OpenSSL 3 legacy provider fails
    to load. Instead of raising an exception, a warning is now
    emitted. The CRYPTOGRAPHY_OPENSSL_NO_LEGACY environment
    variable can still be used to disable the legacy provider at
    runtime.
  * Added support for the CRYPTOGRAPHY_BUILD_OPENSSL_NO_LEGACY
    environment variable during build time, which prevents the
    library from ever attempting to load the legacy provider.
  * Added support for the
    :class:`~cryptography.x509.PrivateKeyUsagePeriod` X.509
    extension. This extension defines the period during which the
    private key corresponding to the certificate's public key may
    be used.
  * Added support for compiling against `aws-lc`_.
  * Parsing X.509 structures now more strictly enforces that Name
    structures do not have malformed ASN.1.
  * We now publish py311 wheels that utilize the faster
    pyo3::buffer::PyBuffer interface, resulting in significantly
    improved performance for operations involving small buffers.
  * Added :func:`~cryptography.hazmat.primitives.serialization.ss
    h_key_fingerprint` for computing fingerprints of SSH public
    keys.
  * Added support for deterministic ECDSA signing via the new
    keyword-only argument ecdsa_deterministic in
    :meth:`~cryptography.x509.CertificateBuilder.sign`, :meth:`~c
    ryptography.x509.CertificateRevocationListBuilder.sign` and :
    meth:`~cryptography.x509.CertificateSigningRequestBuilder.sig
    n`.</changelog>
  <changelog author="James Oakley &lt;jfunk@opensuse.org&gt;" date="1756728000">- Add Make-unsafe-subinterpreter-support-available-via-cfg.patch
  to allow ceph-mgr to load modules (boo#1248987)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1757851200">- update to 45.0.7:
  * Added a function to support an upcoming pyOpenSSL release.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1760356800">- update to 46.0.2:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.4.
  * Fixed an issue where users installing via pip on Python 3.14
    development versions would not properly install a dependency.
  * Fixed an issue building the free-threaded macOS 3.14 wheels.
  * BACKWARDS INCOMPATIBLE: Support for Python 3.7 has been
    removed.
  * Support for OpenSSL &lt; 3.0 is deprecated and will be removed
    in the next release.
  * Support for x86_64 macOS (including publishing wheels) is
    deprecated and will be removed in two releases. We will
    switch to publishing an arm64 only wheel for macOS.
  * Support for 32-bit Windows (including publishing wheels) is
    deprecated and will be removed in two releases. Users should
    move to a 64-bit Python installation.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.3.
  * We now build ppc64le manylinux wheels and publish them to
    PyPI.
  * We now build win_arm64 (Windows on Arm) wheels and publish
    them to PyPI.
  * Added support for free-threaded Python 3.14.
  * Removed the deprecated get_attribute_for_oid method on
    :class:`~cryptography.x509.CertificateSigningRequest`. Users
    should use
    :meth:`~cryptography.x509.Attributes.get_attribute_for_oid`
    instead.
  * Removed the deprecated CAST5, SEED, IDEA, and Blowfish
    classes from the cipher module. These are still available in
    :doc:`/hazmat/decrepit/index`.
  * In X.509, when performing a PSS signature with a SHA-3 hash,
    it is now encoded with the official NIST SHA3 OID.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1765195200">- Only require pytest-subtests with pytest &lt; 9.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1770897600">- Update to 46.0.5 (fixes CVE-2026-26007, bsc#1258074)
  * An attacker could create a malicious public key that reveals portions of
    your private key when using certain uncommon elliptic curves (binary
    curves). This version now includes additional security checks to prevent
    this attack. This issue only affects binary elliptic curves, which are
    rarely used in real-world applications. Credit to XlabAI Team of Tencent
    Xuanwu Lab and Atuin Automated Vulnerability Discovery Engine for reporting
    the issue. CVE-2026-26007
  * Support for SECT* binary elliptic curves is deprecated and will be removed
    in the next release.
- Update to 46.0.4
  * Dropped support for win_arm64 wheels.
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.5.
- Update to 46.0.3
  * Fixed compilation when using LibreSSL 4.2.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1774612800">- update to 46.0.6 (CVE-2026-34073, bsc#1260876):
  * SECURITY ISSUE: Fixed a bug where name constraints were not
    applied to peer names during verification when the leaf
    certificate contains a wildcard DNS SAN. Ordinary X.509
    topologies are not affected by this bug, including those used
    by the Web PKI. Credit to Oleh Konko (1seal) for reporting
    the issue. CVE-2026-34073</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1774958400">- Add patch support-maturin-1.12.patch:
  * Correctly deal with maturin bugfix that installs tests and
    docs under sitearch.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1775822400">- Update to 46.0.7 (fixes CVE-2026-39892, bsc#1261863)
  * **SECURITY ISSUE**: Fixed an issue where non-contiguous buffers could be
    passed to APIs that accept Python buffers, which could lead to buffer
    overflow. **CVE-2026-39892**
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.6.
- drop support-maturin-1.12.patch (upstream)
- drop no-pytest_benchmark.patch,
  Make-unsafe-subinterpreter-support-available-via-cfg.patch:
  obsolete</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1777204800">- update to 47.0.0:
  * Support for Python 3.8 is deprecated and will be removed in
    the next cryptography release.
  * BACKWARDS INCOMPATIBLE: Support for binary elliptic curves
    (SECT* classes) has been removed. These curves are rarely
    used and have additional security considerations that make
    them undesirable.
  * BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.1.x has been
    removed. OpenSSL 3.0.0 or later is now required. LibreSSL,
    BoringSSL, and AWS-LC continue to be supported.
  * BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL &lt; 4.1.
  * BACKWARDS INCOMPATIBLE: Loading keys with unsupported
    algorithms or keys with unsupported explicit curve encodings
    now raises
    :class:`~cryptography.exceptions.UnsupportedAlgorithm`
    instead of ValueError. This change affects :func:`~cryptograp
    hy.hazmat.primitives.serialization.load_pem_private_key`, :fu
    nc:`~cryptography.hazmat.primitives.serialization.load_der_pr
    ivate_key`, :func:`~cryptography.hazmat.primitives.serializat
    ion.load_pem_public_key`, :func:`~cryptography.hazmat.primiti
    ves.serialization.load_der_public_key`, and
    :meth:`~cryptography.x509.Certificate.public_key` when called
    on certificates with unsupported public key algorithms.
  * BACKWARDS INCOMPATIBLE: When parsing elliptic curve private
    keys, we now reject keys that incorrectly encode a private
    key of the wrong length because such keys are impossible to
    process in a constant-time manner. We do not believe keys
    with this problem are in wide use, however we may revert this
    change based on the feedback we receive.
  * Deprecated passing 64-bit (8-byte) and 128-bit (16-byte) keys
    to :class:`~cryptography.hazmat.decrepit.ciphers.algorithms.T
    ripleDES`. In a future release, only 192-bit (24-byte) keys
    will be accepted. Users should expand shorter keys themselves
    (e.g., for single DES: key + key + key, for two-key: key +
    key[:8]).
  * Updated the minimum supported Rust version (MSRV) to 1.83.0,
    from 1.74.0.
  * Support for x86_64 macOS (including publishing wheels) is
    deprecated and will be removed in the next release. We will
    switch to publishing an arm64 only wheel for macOS.
  * Support for 32-bit Windows (including publishing wheels) is
    deprecated and will be removed in the next release. Users
    should move to a 64-bit Python installation.
  * public_bytes and private_bytes methods on keys now raise
    TypeError (instead of ValueError) if an invalid encoding is
    provided for the given format.
  * Moved
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.CFB`,
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.OFB`, and
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.CFB8`
    into :doc:`/hazmat/decrepit/index` and deprecated them in the
    modes module. They will be removed from the modes module in
    49.0.0.
  * Moved :class:`~cryptography.hazmat.primitives.ciphers.algorit
    hms.Camellia` into  :doc:`/hazmat/decrepit/index` and
    deprecated it in the cipher module. It will be removed from
    the cipher module in 49.0.0.
  * Added
    :meth:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF.extract`
    to :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF`.
    The previous private implementation will be removed in
    49.0.0.
  * Added support for loading elliptic curve keys that contain
    explicit encodings of the curves secp256r1, secp384r1, and
    secp521r1.
  * Added support for
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2d`
    and
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2i`
    when using OpenSSL 3.2.0+.
  * Added derive_into methods to
    :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF`,
    :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDFExpand`,
    :class:`~cryptography.hazmat.primitives.kdf.concatkdf.ConcatK
    DFHash`, :class:`~cryptography.hazmat.primitives.kdf.concatkd
    f.ConcatKDFHMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2id`,
    :class:`~cryptography.hazmat.primitives.kdf.pbkdf2.PBKDF2HMAC
    `,
    :class:`~cryptography.hazmat.primitives.kdf.kbkdf.KBKDFHMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.kbkdf.KBKDFCMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.scrypt.Scrypt`,
    and
    :class:`~cryptography.hazmat.primitives.kdf.x963kdf.X963KDF`
    to allow deriving keys directly into pre-allocated buffers.
  * Added encrypt_into and decrypt_into methods to
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESCCM`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESGCM`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESGCMSI
    V`, :class:`~cryptography.hazmat.primitives.ciphers.aead.AESO
    CB3`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESSIV`,
    and :class:`~cryptography.hazmat.primitives.ciphers.aead.ChaC
    ha20Poly1305` to allow encrypting directly into a pre-
    allocated buffer.
  * Added support for PKCS1v15 signing without DigestInfo using :
    class:`~cryptography.hazmat.primitives.asymmetric.utils.NoDig
    estInfo`.
  * Added
    :meth:`~cryptography.hazmat.primitives.hashes.Hash.hash`, a
    one-shot method for computing hashes.
  * Added :doc:`/hazmat/primitives/hpke` support implementing RFC
    9180 for hybrid authenticated encryption.
  * Added new :doc:`/hazmat/primitives/asymmetric/mlkem` module
    with support for ML-KEM key encapsulation with AWS-LC and
    BoringSSL. Note: Post-quantum algorithm support requires AWS-
    LC or BoringSSL. As we ship our wheels with OpenSSL, most
    users will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Note: Post-quantum algorithm support requires AWS-LC or
    BoringSSL. As we ship our wheels with OpenSSL, most users
    will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Added new :doc:`/hazmat/primitives/asymmetric/mldsa` module
    with support for ML-DSA signing and verification with AWS-LC
    and BoringSSL. Note: Post-quantum algorithm support requires
    AWS-LC or BoringSSL. As we ship our wheels with OpenSSL, most
    users will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Note: Post-quantum algorithm support requires AWS-LC or
    BoringSSL. As we ship our wheels with OpenSSL, most users
    will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Added new :doc:`/hazmat/asn1/index` module with support for
    declaratively defining custom ASN.1 types and
    encoding/decoding them.
  * Fixed compilation when using LibreSSL 4.3.0 and OpenSSL
    4.0.0.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 4.0.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1778414400">- update to 48.0.0:
  * BACKWARDS INCOMPATIBLE: Support for Python 3.8 has been
    removed. cryptography now requires Python 3.9 or later.
  * BACKWARDS INCOMPATIBLE: Loading an X.509 CRL whose inner
    TBSCertList.signature algorithm does not match the outer
    signatureAlgorithm now raises ValueError. Previously, such
    CRLs were parsed successfully and only rejected during
    signature validation.
  * Added support for :doc:`/hazmat/primitives/asymmetric/mlkem`
    and :doc:`/hazmat/primitives/asymmetric/mldsa` when using
    OpenSSL 3.5.0 or later, in addition to the existing AWS-LC
    and BoringSSL support. This means post-quantum algorithms are
    now available to users of our wheels. Note: Going forward, we
    do not guarantee that all functionality in cryptography will
    be available when building against OpenSSL. See
    :doc:`/statements/state-of-openssl` for more information.
  * Note: Going forward, we do not guarantee that all
    functionality in cryptography will be available when building
    against OpenSSL. See :doc:`/statements/state-of-openssl` for
    more information.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1781438400">- update to 49.0.0:
  * BACKWARDS INCOMPATIBLE: Removed the deprecated
    PUBLIC_KEY_TYPES, PRIVATE_KEY_TYPES,
    CERTIFICATE_PRIVATE_KEY_TYPES,
    CERTIFICATE_ISSUER_PUBLIC_KEY_TYPES, and
    CERTIFICATE_PUBLIC_KEY_TYPES type aliases. Use
    PublicKeyTypes, PrivateKeyTypes,
    CertificateIssuerPrivateKeyTypes,
    CertificateIssuerPublicKeyTypes, and
    CertificatePublicKeyTypes instead. These were deprecated in
    version 40.0.
  * BACKWARDS INCOMPATIBLE: :class:`~cryptography.hazmat.primitiv
    es.ciphers.algorithms.ChaCha20` now treats the first 4 bytes
    of the nonce as a 32-bit little-endian block counter (as
    defined in RFC 7539) and tracks the number of bytes
    processed. Attempting to encrypt or decrypt more data than
    the counter allows before it would overflow now raises a
    :class:`ValueError` rather than silently diverging from RFC
    7539. Setting the counter portion of the nonce to zero allows
    encrypting up to 256 GiB with a given nonce.
  * BACKWARDS INCOMPATIBLE: Loading an X.509 certificate whose
    ECDSA or DSA signature AlgorithmIdentifier contains encoded
    NULL parameters now raises a :class:`ValueError`. Such
    certificates are invalid, but older versions of Java emitted
    them; previously they loaded with a deprecation warning.
  * Fixed cross-compilation of the CFFI bindings when
    PYO3_CROSS_LIB_DIR is set. The build now derives the Python
    include directory from PYO3_CROSS_LIB_DIR instead of querying
    the host interpreter, which previously caused the build to
    fail during cross-compilations for embedded systems, on hosts
    which have same-version Python development headers installed
    as the target Python.
  * Added support for signing and verifying X.509 certificates,
    certificate signing requests, and certificate revocation
    lists with :doc:`/hazmat/primitives/asymmetric/mldsa` keys,
    as well as loading certificates that contain ML-DSA public
    keys.
  * Added
    :meth:`~cryptography.hazmat.primitives.hpke.KEM.enc_length`
    to :class:`~cryptography.hazmat.primitives.hpke.KEM` so
    callers can split the encapsulated key from the ciphertext
    returned by
    :meth:`~cryptography.hazmat.primitives.hpke.Suite.encrypt`.
  * :meth:`~cryptography.x509.verification.ExtensionPolicy.requir
    e_present`, :meth:`~cryptography.x509.verification.ExtensionP
    olicy.may_be_present`, and :meth:`~cryptography.x509.verifica
    tion.ExtensionPolicy.require_not_present` now accept any
    extension type. Previously only a fixed set of extension
    types was supported, which made it impossible to account for
    otherwise unrecognized critical extensions during path
    validation.
  * Added support for using
    :class:`~cryptography.x509.Certificate`,
    :class:`~cryptography.x509.CertificateSigningRequest`, and
    :class:`~cryptography.x509.CertificateRevocationList` as
    field types in :doc:`/hazmat/asn1/index` structures.
  * Added :func:`~cryptography.hazmat.asn1.value_set`, a class
    decorator that registers an :class:`enum.Enum` subclass as an
    ASN.1 value set: members are encoded as their underlying
    value, and decoding fails if the decoded value does not match
    one of the declared members.
  * Added :meth:`~cryptography.x509.Name.from_bytes` for parsing
    a :class:`~cryptography.x509.Name` from DER bytes, the
    inverse of :meth:`~cryptography.x509.Name.public_bytes`.
  * Added the rsa_padding keyword-only parameter to
    :meth:`~cryptography.x509.CertificateBuilder.public_key`.
    Passing the :class:`~cryptography.hazmat.primitives.asymmetri
    c.padding.PSS` class (not an instance) encodes an RSA subject
    public key in the certificate's subjectPublicKeyInfo with the
    id-RSASSA-PSS OID and no parameters.
  * Added external mu (message representative) support to
    :doc:`/hazmat/primitives/asymmetric/mldsa` via the sign_mu
    and verify_mu methods, which sign and verify a precomputed
    64-byte mu as defined in FIPS 204.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 4.0.1.</changelog>
</package>
<package pkgid="917e07ee0bbe7e32391803998920f13cc1a92c14d3505c8d4785b791354ac25f85ee31ba55bb695405f60769419f95f3fd1ea841212a5f61cce50745c29034b6" name="python313-cryptography-debuginfo" arch="armv7hl">
  <version epoch="0" ver="49.0.0" rel="289.3"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1727524800">- update to 43.0.1:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.3.2.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1729598400">- update to 43.0.3:
  * Fixed release metadata for cryptography-vectors
  * Fixed compilation when using LibreSSL 4.0.0.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1730808000">- Avoid using requires_eq, which after the last modifications
  conflicts with python singlespec (order of expansion).</changelog>
  <changelog author="Ben Greiner &lt;code@bnavigator.de&gt;" date="1731067200">- Fix requires_eq replacement for distributions which do not have
  python3-cffi installed (such as SLE15 python module pythons)
  * gh#openSUSE/python-rpm-macros#185
- Remove outdated section in description</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfyhalomacro@opensuse.org&gt;" date="1737892800">- Update to version 44.0.0:
  * BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL &lt; 3.9.
  * Deprecated Python 3.7 support. Python 3.7 is no longer supported by
    the Python core team. Support for Python 3.7 will be removed in a future
    cryptography release.
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.4.0.
  * macOS wheels are now built against the macOS 10.13 SDK. Users on older
    versions of macOS should upgrade, or they will need to build cryptography
    themselves.
  * Enforce the RFC 5280 requirement that extended key usage extensions must not be empty.
  * Added support for timestamp extraction to the :class:`~cryptography.fernet.MultiFernet` class.
  * Relax the Authority Key Identifier requirements on root CA certificates
    during X.509 verification to allow fields permitted by RFC 5280 but
    forbidden by the CA/Browser BRs.
  * Added support for
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2id` when using
    OpenSSL 3.2.0+.
  * Added support for the :class:`~cryptography.x509.Admissions` certificate extension.
  * Added basic support for PKCS7 decryption (including S/MIME 3.2) via
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der`,
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_pem`,
    and :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_smime`.
- Update specfile to accommodate new project structure at version 44.0.0
- Update no-pytest_benchmark.patch</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1740571200">- update to 44.0.1:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.4.1.
  * We now build armv7l manylinux wheels and publish them to
    PyPI.
  * We now build manylinux_2_34 wheels and publish them to PyPI.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1742731200">- update to 44.0.2:
  * We now build wheels for PyPy 3.11.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1746619200">- Update to 44.0.3
  * Fixed compilation when using LibreSSL 4.1.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1752321600">- update to 45.0.5:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.1.
  * Fixed decrypting PKCS#8 files encrypted with SHA1-RC4. (This
    is not considered secure, and is supported only for backwards
    compatibility.)
  * Fixed decrypting PKCS#8 files encrypted with long salts (this
    impacts keys encrypted by Bouncy Castle).
  * Fixed decrypting PKCS#8 files encrypted with DES-CBC-MD5.
    While wildly insecure, this remains prevalent.
  * Fixed using mypy with cryptography on older versions of
    Python.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.0.
  * Support for Python 3.7 is deprecated and will be removed in
    the next cryptography release.
  * Updated the minimum supported Rust version (MSRV) to 1.74.0,
    from 1.65.0.
  * Added support for serialization of PKCS#12 Java truststores
    in :func:`~cryptography.hazmat.primitives.serialization.pkcs1
    2.serialize_java_truststore`
  * Added :meth:`~cryptography.hazmat.primitives.kdf.argon2.Argon
    2id.derive_phc_encoded` and :meth:`~cryptography.hazmat.primi
    tives.kdf.argon2.Argon2id.verify_phc_encoded` methods to
    support password hashing in the PHC string format
  * Added support for PKCS7 decryption and encryption using
    AES-256 as the content algorithm, in addition to AES-128.
  * BACKWARDS INCOMPATIBLE: Made SSH private key loading more
    consistent with other private key loading: :func:`~cryptograp
    hy.hazmat.primitives.serialization.load_ssh_private_key` now
    raises a TypeError if the key is unencrypted but a password
    is provided (previously no exception was raised), and raises
    a TypeError if the key is encrypted but no password is
    provided (previously a ValueError was raised).
  * Added __copy__ to the :class:`~cryptography.hazmat.primitives
    .asymmetric.ec.EllipticCurvePrivateKey`, :class:`~cryptograph
    y.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey`, :c
    lass:`~cryptography.hazmat.primitives.asymmetric.ed25519.Ed25
    519PublicKey`, :class:`~cryptography.hazmat.primitives.asymme
    tric.ed25519.Ed25519PrivateKey`, :class:`~cryptography.hazmat
    .primitives.asymmetric.ed448.Ed448PublicKey`, :class:`~crypto
    graphy.hazmat.primitives.asymmetric.ed448.Ed448PrivateKey`, :
    class:`~cryptography.hazmat.primitives.asymmetric.x25519.X255
    19PublicKey`, :class:`~cryptography.hazmat.primitives.asymmet
    ric.x25519.X25519PrivateKey`, :class:`~cryptography.hazmat.pr
    imitives.asymmetric.x448.X448PublicKey`, :class:`~cryptograph
    y.hazmat.primitives.asymmetric.x448.X448PrivateKey`, :class:`
    ~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey`
    , :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAP
    ublicKey`, :class:`~cryptography.hazmat.primitives.asymmetric
    .dsa.DSAPrivateKey`, :class:`~cryptography.hazmat.primitives.
    asymmetric.dsa.DSAPublicKey`, :class:`~cryptography.hazmat.pr
    imitives.asymmetric.dh.DHPrivateKey`, and :class:`~cryptograp
    hy.hazmat.primitives.asymmetric.dh.DHPublicKey` abstract base
    classes.
  * We significantly refactored how private key loading ( :func:`
    ~cryptography.hazmat.primitives.serialization.load_pem_privat
    e_key` and :func:`~cryptography.hazmat.primitives.serializati
    on.load_der_private_key`) works. This is intended to be
    backwards compatible for all well-formed keys, therefore if
    you discover a key that now raises an exception, please file
    a bug with instructions for reproducing.
  * Added unsafe_skip_rsa_key_validation keyword-argument to :fun
    c:`~cryptography.hazmat.primitives.serialization.load_ssh_pri
    vate_key`.
  * Added :class:`~cryptography.hazmat.primitives.hashes.XOFHash`
    to support repeated :meth:`~cryptography.hazmat.primitives.ha
    shes.XOFHash.squeeze` operations on extendable output
    functions.
  * Added :meth:`~cryptography.x509.ocsp.OCSPResponseBuilder.add_
    response_by_hash` method to allow creating OCSP responses
    using certificate hash values rather than full certificates.
  * Extended the :mod:`X.509 path validation
    &lt;cryptography.x509.verification&gt;` API to support user-
    configured extension policies via the
    :meth:`PolicyBuilder.extension_policies &lt;cryptography.x509.ve
    rification.PolicyBuilder.extension_policies&gt;` method.
  * Deprecated the subject, verification_time and max_chain_depth
    properties on
    :class:`~cryptography.x509.verification.ClientVerifier` and
    :class:`~cryptography.x509.verification.ServerVerifier` in
    favor of a new policy property. These properties will be
    removed in the next release of cryptography.
  * BACKWARDS INCOMPATIBLE: The :meth:`VerifiedClient.subject
    &lt;cryptography.x509.verification.VerifiedClient.subjects&gt;`
    property can now be None since a custom extension policy may
    allow certificates without a Subject Alternative Name
    extension.
  * Changed the behavior when the OpenSSL 3 legacy provider fails
    to load. Instead of raising an exception, a warning is now
    emitted. The CRYPTOGRAPHY_OPENSSL_NO_LEGACY environment
    variable can still be used to disable the legacy provider at
    runtime.
  * Added support for the CRYPTOGRAPHY_BUILD_OPENSSL_NO_LEGACY
    environment variable during build time, which prevents the
    library from ever attempting to load the legacy provider.
  * Added support for the
    :class:`~cryptography.x509.PrivateKeyUsagePeriod` X.509
    extension. This extension defines the period during which the
    private key corresponding to the certificate's public key may
    be used.
  * Added support for compiling against `aws-lc`_.
  * Parsing X.509 structures now more strictly enforces that Name
    structures do not have malformed ASN.1.
  * We now publish py311 wheels that utilize the faster
    pyo3::buffer::PyBuffer interface, resulting in significantly
    improved performance for operations involving small buffers.
  * Added :func:`~cryptography.hazmat.primitives.serialization.ss
    h_key_fingerprint` for computing fingerprints of SSH public
    keys.
  * Added support for deterministic ECDSA signing via the new
    keyword-only argument ecdsa_deterministic in
    :meth:`~cryptography.x509.CertificateBuilder.sign`, :meth:`~c
    ryptography.x509.CertificateRevocationListBuilder.sign` and :
    meth:`~cryptography.x509.CertificateSigningRequestBuilder.sig
    n`.</changelog>
  <changelog author="James Oakley &lt;jfunk@opensuse.org&gt;" date="1756728000">- Add Make-unsafe-subinterpreter-support-available-via-cfg.patch
  to allow ceph-mgr to load modules (boo#1248987)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1757851200">- update to 45.0.7:
  * Added a function to support an upcoming pyOpenSSL release.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1760356800">- update to 46.0.2:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.4.
  * Fixed an issue where users installing via pip on Python 3.14
    development versions would not properly install a dependency.
  * Fixed an issue building the free-threaded macOS 3.14 wheels.
  * BACKWARDS INCOMPATIBLE: Support for Python 3.7 has been
    removed.
  * Support for OpenSSL &lt; 3.0 is deprecated and will be removed
    in the next release.
  * Support for x86_64 macOS (including publishing wheels) is
    deprecated and will be removed in two releases. We will
    switch to publishing an arm64 only wheel for macOS.
  * Support for 32-bit Windows (including publishing wheels) is
    deprecated and will be removed in two releases. Users should
    move to a 64-bit Python installation.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.3.
  * We now build ppc64le manylinux wheels and publish them to
    PyPI.
  * We now build win_arm64 (Windows on Arm) wheels and publish
    them to PyPI.
  * Added support for free-threaded Python 3.14.
  * Removed the deprecated get_attribute_for_oid method on
    :class:`~cryptography.x509.CertificateSigningRequest`. Users
    should use
    :meth:`~cryptography.x509.Attributes.get_attribute_for_oid`
    instead.
  * Removed the deprecated CAST5, SEED, IDEA, and Blowfish
    classes from the cipher module. These are still available in
    :doc:`/hazmat/decrepit/index`.
  * In X.509, when performing a PSS signature with a SHA-3 hash,
    it is now encoded with the official NIST SHA3 OID.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1765195200">- Only require pytest-subtests with pytest &lt; 9.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1770897600">- Update to 46.0.5 (fixes CVE-2026-26007, bsc#1258074)
  * An attacker could create a malicious public key that reveals portions of
    your private key when using certain uncommon elliptic curves (binary
    curves). This version now includes additional security checks to prevent
    this attack. This issue only affects binary elliptic curves, which are
    rarely used in real-world applications. Credit to XlabAI Team of Tencent
    Xuanwu Lab and Atuin Automated Vulnerability Discovery Engine for reporting
    the issue. CVE-2026-26007
  * Support for SECT* binary elliptic curves is deprecated and will be removed
    in the next release.
- Update to 46.0.4
  * Dropped support for win_arm64 wheels.
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.5.
- Update to 46.0.3
  * Fixed compilation when using LibreSSL 4.2.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1774612800">- update to 46.0.6 (CVE-2026-34073, bsc#1260876):
  * SECURITY ISSUE: Fixed a bug where name constraints were not
    applied to peer names during verification when the leaf
    certificate contains a wildcard DNS SAN. Ordinary X.509
    topologies are not affected by this bug, including those used
    by the Web PKI. Credit to Oleh Konko (1seal) for reporting
    the issue. CVE-2026-34073</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1774958400">- Add patch support-maturin-1.12.patch:
  * Correctly deal with maturin bugfix that installs tests and
    docs under sitearch.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1775822400">- Update to 46.0.7 (fixes CVE-2026-39892, bsc#1261863)
  * **SECURITY ISSUE**: Fixed an issue where non-contiguous buffers could be
    passed to APIs that accept Python buffers, which could lead to buffer
    overflow. **CVE-2026-39892**
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.6.
- drop support-maturin-1.12.patch (upstream)
- drop no-pytest_benchmark.patch,
  Make-unsafe-subinterpreter-support-available-via-cfg.patch:
  obsolete</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1777204800">- update to 47.0.0:
  * Support for Python 3.8 is deprecated and will be removed in
    the next cryptography release.
  * BACKWARDS INCOMPATIBLE: Support for binary elliptic curves
    (SECT* classes) has been removed. These curves are rarely
    used and have additional security considerations that make
    them undesirable.
  * BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.1.x has been
    removed. OpenSSL 3.0.0 or later is now required. LibreSSL,
    BoringSSL, and AWS-LC continue to be supported.
  * BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL &lt; 4.1.
  * BACKWARDS INCOMPATIBLE: Loading keys with unsupported
    algorithms or keys with unsupported explicit curve encodings
    now raises
    :class:`~cryptography.exceptions.UnsupportedAlgorithm`
    instead of ValueError. This change affects :func:`~cryptograp
    hy.hazmat.primitives.serialization.load_pem_private_key`, :fu
    nc:`~cryptography.hazmat.primitives.serialization.load_der_pr
    ivate_key`, :func:`~cryptography.hazmat.primitives.serializat
    ion.load_pem_public_key`, :func:`~cryptography.hazmat.primiti
    ves.serialization.load_der_public_key`, and
    :meth:`~cryptography.x509.Certificate.public_key` when called
    on certificates with unsupported public key algorithms.
  * BACKWARDS INCOMPATIBLE: When parsing elliptic curve private
    keys, we now reject keys that incorrectly encode a private
    key of the wrong length because such keys are impossible to
    process in a constant-time manner. We do not believe keys
    with this problem are in wide use, however we may revert this
    change based on the feedback we receive.
  * Deprecated passing 64-bit (8-byte) and 128-bit (16-byte) keys
    to :class:`~cryptography.hazmat.decrepit.ciphers.algorithms.T
    ripleDES`. In a future release, only 192-bit (24-byte) keys
    will be accepted. Users should expand shorter keys themselves
    (e.g., for single DES: key + key + key, for two-key: key +
    key[:8]).
  * Updated the minimum supported Rust version (MSRV) to 1.83.0,
    from 1.74.0.
  * Support for x86_64 macOS (including publishing wheels) is
    deprecated and will be removed in the next release. We will
    switch to publishing an arm64 only wheel for macOS.
  * Support for 32-bit Windows (including publishing wheels) is
    deprecated and will be removed in the next release. Users
    should move to a 64-bit Python installation.
  * public_bytes and private_bytes methods on keys now raise
    TypeError (instead of ValueError) if an invalid encoding is
    provided for the given format.
  * Moved
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.CFB`,
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.OFB`, and
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.CFB8`
    into :doc:`/hazmat/decrepit/index` and deprecated them in the
    modes module. They will be removed from the modes module in
    49.0.0.
  * Moved :class:`~cryptography.hazmat.primitives.ciphers.algorit
    hms.Camellia` into  :doc:`/hazmat/decrepit/index` and
    deprecated it in the cipher module. It will be removed from
    the cipher module in 49.0.0.
  * Added
    :meth:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF.extract`
    to :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF`.
    The previous private implementation will be removed in
    49.0.0.
  * Added support for loading elliptic curve keys that contain
    explicit encodings of the curves secp256r1, secp384r1, and
    secp521r1.
  * Added support for
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2d`
    and
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2i`
    when using OpenSSL 3.2.0+.
  * Added derive_into methods to
    :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF`,
    :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDFExpand`,
    :class:`~cryptography.hazmat.primitives.kdf.concatkdf.ConcatK
    DFHash`, :class:`~cryptography.hazmat.primitives.kdf.concatkd
    f.ConcatKDFHMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2id`,
    :class:`~cryptography.hazmat.primitives.kdf.pbkdf2.PBKDF2HMAC
    `,
    :class:`~cryptography.hazmat.primitives.kdf.kbkdf.KBKDFHMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.kbkdf.KBKDFCMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.scrypt.Scrypt`,
    and
    :class:`~cryptography.hazmat.primitives.kdf.x963kdf.X963KDF`
    to allow deriving keys directly into pre-allocated buffers.
  * Added encrypt_into and decrypt_into methods to
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESCCM`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESGCM`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESGCMSI
    V`, :class:`~cryptography.hazmat.primitives.ciphers.aead.AESO
    CB3`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESSIV`,
    and :class:`~cryptography.hazmat.primitives.ciphers.aead.ChaC
    ha20Poly1305` to allow encrypting directly into a pre-
    allocated buffer.
  * Added support for PKCS1v15 signing without DigestInfo using :
    class:`~cryptography.hazmat.primitives.asymmetric.utils.NoDig
    estInfo`.
  * Added
    :meth:`~cryptography.hazmat.primitives.hashes.Hash.hash`, a
    one-shot method for computing hashes.
  * Added :doc:`/hazmat/primitives/hpke` support implementing RFC
    9180 for hybrid authenticated encryption.
  * Added new :doc:`/hazmat/primitives/asymmetric/mlkem` module
    with support for ML-KEM key encapsulation with AWS-LC and
    BoringSSL. Note: Post-quantum algorithm support requires AWS-
    LC or BoringSSL. As we ship our wheels with OpenSSL, most
    users will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Note: Post-quantum algorithm support requires AWS-LC or
    BoringSSL. As we ship our wheels with OpenSSL, most users
    will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Added new :doc:`/hazmat/primitives/asymmetric/mldsa` module
    with support for ML-DSA signing and verification with AWS-LC
    and BoringSSL. Note: Post-quantum algorithm support requires
    AWS-LC or BoringSSL. As we ship our wheels with OpenSSL, most
    users will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Note: Post-quantum algorithm support requires AWS-LC or
    BoringSSL. As we ship our wheels with OpenSSL, most users
    will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Added new :doc:`/hazmat/asn1/index` module with support for
    declaratively defining custom ASN.1 types and
    encoding/decoding them.
  * Fixed compilation when using LibreSSL 4.3.0 and OpenSSL
    4.0.0.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 4.0.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1778414400">- update to 48.0.0:
  * BACKWARDS INCOMPATIBLE: Support for Python 3.8 has been
    removed. cryptography now requires Python 3.9 or later.
  * BACKWARDS INCOMPATIBLE: Loading an X.509 CRL whose inner
    TBSCertList.signature algorithm does not match the outer
    signatureAlgorithm now raises ValueError. Previously, such
    CRLs were parsed successfully and only rejected during
    signature validation.
  * Added support for :doc:`/hazmat/primitives/asymmetric/mlkem`
    and :doc:`/hazmat/primitives/asymmetric/mldsa` when using
    OpenSSL 3.5.0 or later, in addition to the existing AWS-LC
    and BoringSSL support. This means post-quantum algorithms are
    now available to users of our wheels. Note: Going forward, we
    do not guarantee that all functionality in cryptography will
    be available when building against OpenSSL. See
    :doc:`/statements/state-of-openssl` for more information.
  * Note: Going forward, we do not guarantee that all
    functionality in cryptography will be available when building
    against OpenSSL. See :doc:`/statements/state-of-openssl` for
    more information.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1781438400">- update to 49.0.0:
  * BACKWARDS INCOMPATIBLE: Removed the deprecated
    PUBLIC_KEY_TYPES, PRIVATE_KEY_TYPES,
    CERTIFICATE_PRIVATE_KEY_TYPES,
    CERTIFICATE_ISSUER_PUBLIC_KEY_TYPES, and
    CERTIFICATE_PUBLIC_KEY_TYPES type aliases. Use
    PublicKeyTypes, PrivateKeyTypes,
    CertificateIssuerPrivateKeyTypes,
    CertificateIssuerPublicKeyTypes, and
    CertificatePublicKeyTypes instead. These were deprecated in
    version 40.0.
  * BACKWARDS INCOMPATIBLE: :class:`~cryptography.hazmat.primitiv
    es.ciphers.algorithms.ChaCha20` now treats the first 4 bytes
    of the nonce as a 32-bit little-endian block counter (as
    defined in RFC 7539) and tracks the number of bytes
    processed. Attempting to encrypt or decrypt more data than
    the counter allows before it would overflow now raises a
    :class:`ValueError` rather than silently diverging from RFC
    7539. Setting the counter portion of the nonce to zero allows
    encrypting up to 256 GiB with a given nonce.
  * BACKWARDS INCOMPATIBLE: Loading an X.509 certificate whose
    ECDSA or DSA signature AlgorithmIdentifier contains encoded
    NULL parameters now raises a :class:`ValueError`. Such
    certificates are invalid, but older versions of Java emitted
    them; previously they loaded with a deprecation warning.
  * Fixed cross-compilation of the CFFI bindings when
    PYO3_CROSS_LIB_DIR is set. The build now derives the Python
    include directory from PYO3_CROSS_LIB_DIR instead of querying
    the host interpreter, which previously caused the build to
    fail during cross-compilations for embedded systems, on hosts
    which have same-version Python development headers installed
    as the target Python.
  * Added support for signing and verifying X.509 certificates,
    certificate signing requests, and certificate revocation
    lists with :doc:`/hazmat/primitives/asymmetric/mldsa` keys,
    as well as loading certificates that contain ML-DSA public
    keys.
  * Added
    :meth:`~cryptography.hazmat.primitives.hpke.KEM.enc_length`
    to :class:`~cryptography.hazmat.primitives.hpke.KEM` so
    callers can split the encapsulated key from the ciphertext
    returned by
    :meth:`~cryptography.hazmat.primitives.hpke.Suite.encrypt`.
  * :meth:`~cryptography.x509.verification.ExtensionPolicy.requir
    e_present`, :meth:`~cryptography.x509.verification.ExtensionP
    olicy.may_be_present`, and :meth:`~cryptography.x509.verifica
    tion.ExtensionPolicy.require_not_present` now accept any
    extension type. Previously only a fixed set of extension
    types was supported, which made it impossible to account for
    otherwise unrecognized critical extensions during path
    validation.
  * Added support for using
    :class:`~cryptography.x509.Certificate`,
    :class:`~cryptography.x509.CertificateSigningRequest`, and
    :class:`~cryptography.x509.CertificateRevocationList` as
    field types in :doc:`/hazmat/asn1/index` structures.
  * Added :func:`~cryptography.hazmat.asn1.value_set`, a class
    decorator that registers an :class:`enum.Enum` subclass as an
    ASN.1 value set: members are encoded as their underlying
    value, and decoding fails if the decoded value does not match
    one of the declared members.
  * Added :meth:`~cryptography.x509.Name.from_bytes` for parsing
    a :class:`~cryptography.x509.Name` from DER bytes, the
    inverse of :meth:`~cryptography.x509.Name.public_bytes`.
  * Added the rsa_padding keyword-only parameter to
    :meth:`~cryptography.x509.CertificateBuilder.public_key`.
    Passing the :class:`~cryptography.hazmat.primitives.asymmetri
    c.padding.PSS` class (not an instance) encodes an RSA subject
    public key in the certificate's subjectPublicKeyInfo with the
    id-RSASSA-PSS OID and no parameters.
  * Added external mu (message representative) support to
    :doc:`/hazmat/primitives/asymmetric/mldsa` via the sign_mu
    and verify_mu methods, which sign and verify a precomputed
    64-byte mu as defined in FIPS 204.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 4.0.1.</changelog>
</package>
<package pkgid="06dd3ff722290e75c9142d52ba4a857814f8492934f66625b8e6c9ae6601c56374e356e9bcddf6095eb09a51f8beb9835d0233b13aef7b60a2d2feebb6690038" name="python313-cryptography-debuginfo" arch="x86_64">
  <version epoch="0" ver="49.0.0" rel="289.3"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1727524800">- update to 43.0.1:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.3.2.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1729598400">- update to 43.0.3:
  * Fixed release metadata for cryptography-vectors
  * Fixed compilation when using LibreSSL 4.0.0.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1730808000">- Avoid using requires_eq, which after the last modifications
  conflicts with python singlespec (order of expansion).</changelog>
  <changelog author="Ben Greiner &lt;code@bnavigator.de&gt;" date="1731067200">- Fix requires_eq replacement for distributions which do not have
  python3-cffi installed (such as SLE15 python module pythons)
  * gh#openSUSE/python-rpm-macros#185
- Remove outdated section in description</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfyhalomacro@opensuse.org&gt;" date="1737892800">- Update to version 44.0.0:
  * BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL &lt; 3.9.
  * Deprecated Python 3.7 support. Python 3.7 is no longer supported by
    the Python core team. Support for Python 3.7 will be removed in a future
    cryptography release.
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.4.0.
  * macOS wheels are now built against the macOS 10.13 SDK. Users on older
    versions of macOS should upgrade, or they will need to build cryptography
    themselves.
  * Enforce the RFC 5280 requirement that extended key usage extensions must not be empty.
  * Added support for timestamp extraction to the :class:`~cryptography.fernet.MultiFernet` class.
  * Relax the Authority Key Identifier requirements on root CA certificates
    during X.509 verification to allow fields permitted by RFC 5280 but
    forbidden by the CA/Browser BRs.
  * Added support for
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2id` when using
    OpenSSL 3.2.0+.
  * Added support for the :class:`~cryptography.x509.Admissions` certificate extension.
  * Added basic support for PKCS7 decryption (including S/MIME 3.2) via
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der`,
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_pem`,
    and :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_smime`.
- Update specfile to accommodate new project structure at version 44.0.0
- Update no-pytest_benchmark.patch</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1740571200">- update to 44.0.1:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.4.1.
  * We now build armv7l manylinux wheels and publish them to
    PyPI.
  * We now build manylinux_2_34 wheels and publish them to PyPI.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1742731200">- update to 44.0.2:
  * We now build wheels for PyPy 3.11.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1746619200">- Update to 44.0.3
  * Fixed compilation when using LibreSSL 4.1.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1752321600">- update to 45.0.5:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.1.
  * Fixed decrypting PKCS#8 files encrypted with SHA1-RC4. (This
    is not considered secure, and is supported only for backwards
    compatibility.)
  * Fixed decrypting PKCS#8 files encrypted with long salts (this
    impacts keys encrypted by Bouncy Castle).
  * Fixed decrypting PKCS#8 files encrypted with DES-CBC-MD5.
    While wildly insecure, this remains prevalent.
  * Fixed using mypy with cryptography on older versions of
    Python.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.0.
  * Support for Python 3.7 is deprecated and will be removed in
    the next cryptography release.
  * Updated the minimum supported Rust version (MSRV) to 1.74.0,
    from 1.65.0.
  * Added support for serialization of PKCS#12 Java truststores
    in :func:`~cryptography.hazmat.primitives.serialization.pkcs1
    2.serialize_java_truststore`
  * Added :meth:`~cryptography.hazmat.primitives.kdf.argon2.Argon
    2id.derive_phc_encoded` and :meth:`~cryptography.hazmat.primi
    tives.kdf.argon2.Argon2id.verify_phc_encoded` methods to
    support password hashing in the PHC string format
  * Added support for PKCS7 decryption and encryption using
    AES-256 as the content algorithm, in addition to AES-128.
  * BACKWARDS INCOMPATIBLE: Made SSH private key loading more
    consistent with other private key loading: :func:`~cryptograp
    hy.hazmat.primitives.serialization.load_ssh_private_key` now
    raises a TypeError if the key is unencrypted but a password
    is provided (previously no exception was raised), and raises
    a TypeError if the key is encrypted but no password is
    provided (previously a ValueError was raised).
  * Added __copy__ to the :class:`~cryptography.hazmat.primitives
    .asymmetric.ec.EllipticCurvePrivateKey`, :class:`~cryptograph
    y.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey`, :c
    lass:`~cryptography.hazmat.primitives.asymmetric.ed25519.Ed25
    519PublicKey`, :class:`~cryptography.hazmat.primitives.asymme
    tric.ed25519.Ed25519PrivateKey`, :class:`~cryptography.hazmat
    .primitives.asymmetric.ed448.Ed448PublicKey`, :class:`~crypto
    graphy.hazmat.primitives.asymmetric.ed448.Ed448PrivateKey`, :
    class:`~cryptography.hazmat.primitives.asymmetric.x25519.X255
    19PublicKey`, :class:`~cryptography.hazmat.primitives.asymmet
    ric.x25519.X25519PrivateKey`, :class:`~cryptography.hazmat.pr
    imitives.asymmetric.x448.X448PublicKey`, :class:`~cryptograph
    y.hazmat.primitives.asymmetric.x448.X448PrivateKey`, :class:`
    ~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey`
    , :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAP
    ublicKey`, :class:`~cryptography.hazmat.primitives.asymmetric
    .dsa.DSAPrivateKey`, :class:`~cryptography.hazmat.primitives.
    asymmetric.dsa.DSAPublicKey`, :class:`~cryptography.hazmat.pr
    imitives.asymmetric.dh.DHPrivateKey`, and :class:`~cryptograp
    hy.hazmat.primitives.asymmetric.dh.DHPublicKey` abstract base
    classes.
  * We significantly refactored how private key loading ( :func:`
    ~cryptography.hazmat.primitives.serialization.load_pem_privat
    e_key` and :func:`~cryptography.hazmat.primitives.serializati
    on.load_der_private_key`) works. This is intended to be
    backwards compatible for all well-formed keys, therefore if
    you discover a key that now raises an exception, please file
    a bug with instructions for reproducing.
  * Added unsafe_skip_rsa_key_validation keyword-argument to :fun
    c:`~cryptography.hazmat.primitives.serialization.load_ssh_pri
    vate_key`.
  * Added :class:`~cryptography.hazmat.primitives.hashes.XOFHash`
    to support repeated :meth:`~cryptography.hazmat.primitives.ha
    shes.XOFHash.squeeze` operations on extendable output
    functions.
  * Added :meth:`~cryptography.x509.ocsp.OCSPResponseBuilder.add_
    response_by_hash` method to allow creating OCSP responses
    using certificate hash values rather than full certificates.
  * Extended the :mod:`X.509 path validation
    &lt;cryptography.x509.verification&gt;` API to support user-
    configured extension policies via the
    :meth:`PolicyBuilder.extension_policies &lt;cryptography.x509.ve
    rification.PolicyBuilder.extension_policies&gt;` method.
  * Deprecated the subject, verification_time and max_chain_depth
    properties on
    :class:`~cryptography.x509.verification.ClientVerifier` and
    :class:`~cryptography.x509.verification.ServerVerifier` in
    favor of a new policy property. These properties will be
    removed in the next release of cryptography.
  * BACKWARDS INCOMPATIBLE: The :meth:`VerifiedClient.subject
    &lt;cryptography.x509.verification.VerifiedClient.subjects&gt;`
    property can now be None since a custom extension policy may
    allow certificates without a Subject Alternative Name
    extension.
  * Changed the behavior when the OpenSSL 3 legacy provider fails
    to load. Instead of raising an exception, a warning is now
    emitted. The CRYPTOGRAPHY_OPENSSL_NO_LEGACY environment
    variable can still be used to disable the legacy provider at
    runtime.
  * Added support for the CRYPTOGRAPHY_BUILD_OPENSSL_NO_LEGACY
    environment variable during build time, which prevents the
    library from ever attempting to load the legacy provider.
  * Added support for the
    :class:`~cryptography.x509.PrivateKeyUsagePeriod` X.509
    extension. This extension defines the period during which the
    private key corresponding to the certificate's public key may
    be used.
  * Added support for compiling against `aws-lc`_.
  * Parsing X.509 structures now more strictly enforces that Name
    structures do not have malformed ASN.1.
  * We now publish py311 wheels that utilize the faster
    pyo3::buffer::PyBuffer interface, resulting in significantly
    improved performance for operations involving small buffers.
  * Added :func:`~cryptography.hazmat.primitives.serialization.ss
    h_key_fingerprint` for computing fingerprints of SSH public
    keys.
  * Added support for deterministic ECDSA signing via the new
    keyword-only argument ecdsa_deterministic in
    :meth:`~cryptography.x509.CertificateBuilder.sign`, :meth:`~c
    ryptography.x509.CertificateRevocationListBuilder.sign` and :
    meth:`~cryptography.x509.CertificateSigningRequestBuilder.sig
    n`.</changelog>
  <changelog author="James Oakley &lt;jfunk@opensuse.org&gt;" date="1756728000">- Add Make-unsafe-subinterpreter-support-available-via-cfg.patch
  to allow ceph-mgr to load modules (boo#1248987)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1757851200">- update to 45.0.7:
  * Added a function to support an upcoming pyOpenSSL release.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1760356800">- update to 46.0.2:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.4.
  * Fixed an issue where users installing via pip on Python 3.14
    development versions would not properly install a dependency.
  * Fixed an issue building the free-threaded macOS 3.14 wheels.
  * BACKWARDS INCOMPATIBLE: Support for Python 3.7 has been
    removed.
  * Support for OpenSSL &lt; 3.0 is deprecated and will be removed
    in the next release.
  * Support for x86_64 macOS (including publishing wheels) is
    deprecated and will be removed in two releases. We will
    switch to publishing an arm64 only wheel for macOS.
  * Support for 32-bit Windows (including publishing wheels) is
    deprecated and will be removed in two releases. Users should
    move to a 64-bit Python installation.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.3.
  * We now build ppc64le manylinux wheels and publish them to
    PyPI.
  * We now build win_arm64 (Windows on Arm) wheels and publish
    them to PyPI.
  * Added support for free-threaded Python 3.14.
  * Removed the deprecated get_attribute_for_oid method on
    :class:`~cryptography.x509.CertificateSigningRequest`. Users
    should use
    :meth:`~cryptography.x509.Attributes.get_attribute_for_oid`
    instead.
  * Removed the deprecated CAST5, SEED, IDEA, and Blowfish
    classes from the cipher module. These are still available in
    :doc:`/hazmat/decrepit/index`.
  * In X.509, when performing a PSS signature with a SHA-3 hash,
    it is now encoded with the official NIST SHA3 OID.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1765195200">- Only require pytest-subtests with pytest &lt; 9.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1770897600">- Update to 46.0.5 (fixes CVE-2026-26007, bsc#1258074)
  * An attacker could create a malicious public key that reveals portions of
    your private key when using certain uncommon elliptic curves (binary
    curves). This version now includes additional security checks to prevent
    this attack. This issue only affects binary elliptic curves, which are
    rarely used in real-world applications. Credit to XlabAI Team of Tencent
    Xuanwu Lab and Atuin Automated Vulnerability Discovery Engine for reporting
    the issue. CVE-2026-26007
  * Support for SECT* binary elliptic curves is deprecated and will be removed
    in the next release.
- Update to 46.0.4
  * Dropped support for win_arm64 wheels.
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.5.
- Update to 46.0.3
  * Fixed compilation when using LibreSSL 4.2.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1774612800">- update to 46.0.6 (CVE-2026-34073, bsc#1260876):
  * SECURITY ISSUE: Fixed a bug where name constraints were not
    applied to peer names during verification when the leaf
    certificate contains a wildcard DNS SAN. Ordinary X.509
    topologies are not affected by this bug, including those used
    by the Web PKI. Credit to Oleh Konko (1seal) for reporting
    the issue. CVE-2026-34073</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1774958400">- Add patch support-maturin-1.12.patch:
  * Correctly deal with maturin bugfix that installs tests and
    docs under sitearch.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1775822400">- Update to 46.0.7 (fixes CVE-2026-39892, bsc#1261863)
  * **SECURITY ISSUE**: Fixed an issue where non-contiguous buffers could be
    passed to APIs that accept Python buffers, which could lead to buffer
    overflow. **CVE-2026-39892**
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.6.
- drop support-maturin-1.12.patch (upstream)
- drop no-pytest_benchmark.patch,
  Make-unsafe-subinterpreter-support-available-via-cfg.patch:
  obsolete</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1777204800">- update to 47.0.0:
  * Support for Python 3.8 is deprecated and will be removed in
    the next cryptography release.
  * BACKWARDS INCOMPATIBLE: Support for binary elliptic curves
    (SECT* classes) has been removed. These curves are rarely
    used and have additional security considerations that make
    them undesirable.
  * BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.1.x has been
    removed. OpenSSL 3.0.0 or later is now required. LibreSSL,
    BoringSSL, and AWS-LC continue to be supported.
  * BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL &lt; 4.1.
  * BACKWARDS INCOMPATIBLE: Loading keys with unsupported
    algorithms or keys with unsupported explicit curve encodings
    now raises
    :class:`~cryptography.exceptions.UnsupportedAlgorithm`
    instead of ValueError. This change affects :func:`~cryptograp
    hy.hazmat.primitives.serialization.load_pem_private_key`, :fu
    nc:`~cryptography.hazmat.primitives.serialization.load_der_pr
    ivate_key`, :func:`~cryptography.hazmat.primitives.serializat
    ion.load_pem_public_key`, :func:`~cryptography.hazmat.primiti
    ves.serialization.load_der_public_key`, and
    :meth:`~cryptography.x509.Certificate.public_key` when called
    on certificates with unsupported public key algorithms.
  * BACKWARDS INCOMPATIBLE: When parsing elliptic curve private
    keys, we now reject keys that incorrectly encode a private
    key of the wrong length because such keys are impossible to
    process in a constant-time manner. We do not believe keys
    with this problem are in wide use, however we may revert this
    change based on the feedback we receive.
  * Deprecated passing 64-bit (8-byte) and 128-bit (16-byte) keys
    to :class:`~cryptography.hazmat.decrepit.ciphers.algorithms.T
    ripleDES`. In a future release, only 192-bit (24-byte) keys
    will be accepted. Users should expand shorter keys themselves
    (e.g., for single DES: key + key + key, for two-key: key +
    key[:8]).
  * Updated the minimum supported Rust version (MSRV) to 1.83.0,
    from 1.74.0.
  * Support for x86_64 macOS (including publishing wheels) is
    deprecated and will be removed in the next release. We will
    switch to publishing an arm64 only wheel for macOS.
  * Support for 32-bit Windows (including publishing wheels) is
    deprecated and will be removed in the next release. Users
    should move to a 64-bit Python installation.
  * public_bytes and private_bytes methods on keys now raise
    TypeError (instead of ValueError) if an invalid encoding is
    provided for the given format.
  * Moved
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.CFB`,
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.OFB`, and
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.CFB8`
    into :doc:`/hazmat/decrepit/index` and deprecated them in the
    modes module. They will be removed from the modes module in
    49.0.0.
  * Moved :class:`~cryptography.hazmat.primitives.ciphers.algorit
    hms.Camellia` into  :doc:`/hazmat/decrepit/index` and
    deprecated it in the cipher module. It will be removed from
    the cipher module in 49.0.0.
  * Added
    :meth:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF.extract`
    to :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF`.
    The previous private implementation will be removed in
    49.0.0.
  * Added support for loading elliptic curve keys that contain
    explicit encodings of the curves secp256r1, secp384r1, and
    secp521r1.
  * Added support for
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2d`
    and
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2i`
    when using OpenSSL 3.2.0+.
  * Added derive_into methods to
    :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF`,
    :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDFExpand`,
    :class:`~cryptography.hazmat.primitives.kdf.concatkdf.ConcatK
    DFHash`, :class:`~cryptography.hazmat.primitives.kdf.concatkd
    f.ConcatKDFHMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2id`,
    :class:`~cryptography.hazmat.primitives.kdf.pbkdf2.PBKDF2HMAC
    `,
    :class:`~cryptography.hazmat.primitives.kdf.kbkdf.KBKDFHMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.kbkdf.KBKDFCMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.scrypt.Scrypt`,
    and
    :class:`~cryptography.hazmat.primitives.kdf.x963kdf.X963KDF`
    to allow deriving keys directly into pre-allocated buffers.
  * Added encrypt_into and decrypt_into methods to
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESCCM`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESGCM`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESGCMSI
    V`, :class:`~cryptography.hazmat.primitives.ciphers.aead.AESO
    CB3`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESSIV`,
    and :class:`~cryptography.hazmat.primitives.ciphers.aead.ChaC
    ha20Poly1305` to allow encrypting directly into a pre-
    allocated buffer.
  * Added support for PKCS1v15 signing without DigestInfo using :
    class:`~cryptography.hazmat.primitives.asymmetric.utils.NoDig
    estInfo`.
  * Added
    :meth:`~cryptography.hazmat.primitives.hashes.Hash.hash`, a
    one-shot method for computing hashes.
  * Added :doc:`/hazmat/primitives/hpke` support implementing RFC
    9180 for hybrid authenticated encryption.
  * Added new :doc:`/hazmat/primitives/asymmetric/mlkem` module
    with support for ML-KEM key encapsulation with AWS-LC and
    BoringSSL. Note: Post-quantum algorithm support requires AWS-
    LC or BoringSSL. As we ship our wheels with OpenSSL, most
    users will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Note: Post-quantum algorithm support requires AWS-LC or
    BoringSSL. As we ship our wheels with OpenSSL, most users
    will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Added new :doc:`/hazmat/primitives/asymmetric/mldsa` module
    with support for ML-DSA signing and verification with AWS-LC
    and BoringSSL. Note: Post-quantum algorithm support requires
    AWS-LC or BoringSSL. As we ship our wheels with OpenSSL, most
    users will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Note: Post-quantum algorithm support requires AWS-LC or
    BoringSSL. As we ship our wheels with OpenSSL, most users
    will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Added new :doc:`/hazmat/asn1/index` module with support for
    declaratively defining custom ASN.1 types and
    encoding/decoding them.
  * Fixed compilation when using LibreSSL 4.3.0 and OpenSSL
    4.0.0.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 4.0.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1778414400">- update to 48.0.0:
  * BACKWARDS INCOMPATIBLE: Support for Python 3.8 has been
    removed. cryptography now requires Python 3.9 or later.
  * BACKWARDS INCOMPATIBLE: Loading an X.509 CRL whose inner
    TBSCertList.signature algorithm does not match the outer
    signatureAlgorithm now raises ValueError. Previously, such
    CRLs were parsed successfully and only rejected during
    signature validation.
  * Added support for :doc:`/hazmat/primitives/asymmetric/mlkem`
    and :doc:`/hazmat/primitives/asymmetric/mldsa` when using
    OpenSSL 3.5.0 or later, in addition to the existing AWS-LC
    and BoringSSL support. This means post-quantum algorithms are
    now available to users of our wheels. Note: Going forward, we
    do not guarantee that all functionality in cryptography will
    be available when building against OpenSSL. See
    :doc:`/statements/state-of-openssl` for more information.
  * Note: Going forward, we do not guarantee that all
    functionality in cryptography will be available when building
    against OpenSSL. See :doc:`/statements/state-of-openssl` for
    more information.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1781438400">- update to 49.0.0:
  * BACKWARDS INCOMPATIBLE: Removed the deprecated
    PUBLIC_KEY_TYPES, PRIVATE_KEY_TYPES,
    CERTIFICATE_PRIVATE_KEY_TYPES,
    CERTIFICATE_ISSUER_PUBLIC_KEY_TYPES, and
    CERTIFICATE_PUBLIC_KEY_TYPES type aliases. Use
    PublicKeyTypes, PrivateKeyTypes,
    CertificateIssuerPrivateKeyTypes,
    CertificateIssuerPublicKeyTypes, and
    CertificatePublicKeyTypes instead. These were deprecated in
    version 40.0.
  * BACKWARDS INCOMPATIBLE: :class:`~cryptography.hazmat.primitiv
    es.ciphers.algorithms.ChaCha20` now treats the first 4 bytes
    of the nonce as a 32-bit little-endian block counter (as
    defined in RFC 7539) and tracks the number of bytes
    processed. Attempting to encrypt or decrypt more data than
    the counter allows before it would overflow now raises a
    :class:`ValueError` rather than silently diverging from RFC
    7539. Setting the counter portion of the nonce to zero allows
    encrypting up to 256 GiB with a given nonce.
  * BACKWARDS INCOMPATIBLE: Loading an X.509 certificate whose
    ECDSA or DSA signature AlgorithmIdentifier contains encoded
    NULL parameters now raises a :class:`ValueError`. Such
    certificates are invalid, but older versions of Java emitted
    them; previously they loaded with a deprecation warning.
  * Fixed cross-compilation of the CFFI bindings when
    PYO3_CROSS_LIB_DIR is set. The build now derives the Python
    include directory from PYO3_CROSS_LIB_DIR instead of querying
    the host interpreter, which previously caused the build to
    fail during cross-compilations for embedded systems, on hosts
    which have same-version Python development headers installed
    as the target Python.
  * Added support for signing and verifying X.509 certificates,
    certificate signing requests, and certificate revocation
    lists with :doc:`/hazmat/primitives/asymmetric/mldsa` keys,
    as well as loading certificates that contain ML-DSA public
    keys.
  * Added
    :meth:`~cryptography.hazmat.primitives.hpke.KEM.enc_length`
    to :class:`~cryptography.hazmat.primitives.hpke.KEM` so
    callers can split the encapsulated key from the ciphertext
    returned by
    :meth:`~cryptography.hazmat.primitives.hpke.Suite.encrypt`.
  * :meth:`~cryptography.x509.verification.ExtensionPolicy.requir
    e_present`, :meth:`~cryptography.x509.verification.ExtensionP
    olicy.may_be_present`, and :meth:`~cryptography.x509.verifica
    tion.ExtensionPolicy.require_not_present` now accept any
    extension type. Previously only a fixed set of extension
    types was supported, which made it impossible to account for
    otherwise unrecognized critical extensions during path
    validation.
  * Added support for using
    :class:`~cryptography.x509.Certificate`,
    :class:`~cryptography.x509.CertificateSigningRequest`, and
    :class:`~cryptography.x509.CertificateRevocationList` as
    field types in :doc:`/hazmat/asn1/index` structures.
  * Added :func:`~cryptography.hazmat.asn1.value_set`, a class
    decorator that registers an :class:`enum.Enum` subclass as an
    ASN.1 value set: members are encoded as their underlying
    value, and decoding fails if the decoded value does not match
    one of the declared members.
  * Added :meth:`~cryptography.x509.Name.from_bytes` for parsing
    a :class:`~cryptography.x509.Name` from DER bytes, the
    inverse of :meth:`~cryptography.x509.Name.public_bytes`.
  * Added the rsa_padding keyword-only parameter to
    :meth:`~cryptography.x509.CertificateBuilder.public_key`.
    Passing the :class:`~cryptography.hazmat.primitives.asymmetri
    c.padding.PSS` class (not an instance) encodes an RSA subject
    public key in the certificate's subjectPublicKeyInfo with the
    id-RSASSA-PSS OID and no parameters.
  * Added external mu (message representative) support to
    :doc:`/hazmat/primitives/asymmetric/mldsa` via the sign_mu
    and verify_mu methods, which sign and verify a precomputed
    64-byte mu as defined in FIPS 204.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 4.0.1.</changelog>
</package>
<package pkgid="05c1bf35bf628f24af8339b5ee0f98ee77d976afe95318b3053e2ca1ae2508ee937b83642311f76d9954d5abefd5b446d0ea95a51f5f4a13359279006b8215f6" name="python313-libnacl" arch="noarch">
  <version epoch="0" ver="2.1.0" rel="63.13"/>
  <changelog author="tchvatal@suse.com" date="1533902400">- Fix the libsodium dependency on the runtime to be copied by macros
- Install license file</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1571054400">- Replace %fdupes -s with plain %fdupes; hardlinks are better.</changelog>
  <changelog author="Ond&#x159;ej S&#xFA;kup &lt;mimi.vx@gmail.com&gt;" date="1583236800">- update to 1.7.1
  * Bindings for kdf in libsodium
  * Added extra key validation
  * Add Crypto_box_easy</changelog>
  <changelog author="Niels Abspoel &lt;aboe76@gmail.com&gt;" date="1612180800">- Update to 1.7.2
  * remove encoding parameter json.loads for python 3.9 compatibility
  * implement functions for equal-comparison and hashing keys
  * improved spec file</changelog>
  <changelog author="Niels Abspoel &lt;aboe76@gmail.com&gt;" date="1613649600">- Revert libsodium requirement back to libsodium23</changelog>
  <changelog author="Niels Abspoel &lt;aboe76@gmail.com&gt;" date="1623412800">- add crypto_kdf_derive.patch to fix crypto_kdf_derive_from_key() on 32-bit platforms</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1688558400">- Add %{?sle15_python_module_pythons}</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1709294400">- Update to 2.1.0:
  * Added classes to the libnacl.aead module allowing for the use of
    XChaCha20-Poly1305-IETF, ChaCha20-Poly1305-IETF, and AES256-GCM.
  * Added the libnacl.kx module. This module contains the ExchangeKey class.
- Switch to autosetup and pyproject macros.
- Drop patch crypto_kdf_derive.patch, no longer required.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1718193600">- update to libsodium26</changelog>
  <changelog author="Max Lin &lt;mlin@suse.com&gt;" date="1755864000">- Use BuildRequires: poetry-core to instead of BuildRequires: poetry</changelog>
</package>
<package pkgid="8c90fb593148119aa93de2718b0ee89fa30ccf2bbb7ec9b952f48ac5430f785b3c6fad0e983eaeb4c85307b70a1e171355a132b8f4c2deb8e0948a73c75fce59" name="python313-logutils" arch="noarch">
  <version epoch="0" ver="0.3.5" rel="30.30"/>
  <changelog author="speilicke@suse.com" date="1374148800">- Initial version</changelog>
  <changelog author="tbechtold@suse.com" date="1498737600">- update to 0.3.5:
  - Bring QueueListener implementation in line with the version in the stdlib.
  - Fixed a bug in ColorizingStreamHandler relating to encoding.
  - Return non-zero error code from "setup.py test" when a test fails.
  - Make the dictConfig tests work with both Python 2.x and 3.x.
- convert to singlespec
- fix Source url
- split -doc package
- update Url</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1543924800">- Remove superfluous devel dependency for noarch package</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1622894400">- add sphinx4.patch to enable build with Sphinx 4.x</changelog>
  <changelog author="pgajdos@suse.com" date="1630497600">- %check: use %pyunittest rpm macro</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1676635200">- update path for SLE15</changelog>
  <changelog author="Ben Greiner &lt;code@bnavigator.de&gt;" date="1705579200">- Add logutils-pr1-fix-testasserts-py3.12.patch
  * https://bitbucket.org/vinay.sajip/logutils/pull-requests/1
  * Fixes the test suite. This package is really old but still
    half-maintained
- Switch to PEP517
- Deduplicate files</changelog>
  <changelog author="Christoph G &lt;foss@grueninger.de&gt;" date="1725537600">- Add patch logutils-intersphinx.patch to fix compatibility
  with recent Sphinx</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1725969600">- Add patch use-logging-lock-directly.patch:
  * Use logging._lock as a context manager.
- Switch to autosetup macro.</changelog>
</package>
<package pkgid="c8e7bd7b0c79cbb330f106ddfb92745a7e53a7a0d360d74ea6061601b399cad67b9819cd37ea0abd9428a51f6dd11fc696409b435a8d120c14a65de6d7daf97a" name="python314-Routes" arch="noarch">
  <version epoch="0" ver="2.5.1" rel="56.7"/>
  <changelog author="tbechtold@suse.com" date="1464955200">- update to 2.3.1:
  * Backwards compatability fix - connect should work with mandatory
    routename and optional path. Patch by Davanum Srinivas (PR #65).
  * Fix sub_domain equivalence check. Patch by Nikita Uvarov
  * Add support for protocol-relative URLs generation (i.e. starting with double
    slash ``//``). PR #60. Patch by Sviatoslav Sydorenko.
  * Add support for the ``middleware`` extra requirement, making possible to
    depend on ``webob`` optionally. PR #59. Patch by Sviatoslav Sydorenko.
  * Fix matching of an empty string route, which led to exception in earlier
    versions. PR #58. Patch by Sviatoslav Sydorenko.
  * Add support for the ``requirements`` option when using
    mapper.resource to create routes. PR #57. Patch by Sean Dague.
  * Concatenation fix when using submappers with path prefixes. Multiple
    submappers combined the path prefix inside the controller argument in
    non-obvious ways. The controller argument will now be properly carried
    through when using submappers. PR #28.</changelog>
  <changelog author="tbechtold@suse.com" date="1498737600">- update to 2.4.1:
  * Release as a universal wheel. PR #75.
  * Convert readthedocs links for their .org -&gt; .io migration for hosted projects.
- convert to singlespec
- Fix Source url</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1543924800">- Remove superfluous devel dependency for noarch package</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1573128000">- Run through spec-cleaner</changelog>
  <changelog author="pgajdos@suse.com" date="1592395200">- nose -&gt; pytest</changelog>
  <changelog author="Dirk Mueller &lt;dmueller@suse.com&gt;" date="1606392000">- update to 2.5.1:
  * Add compatibility for Python 3.7+.
  * Add graceful fallback for invalid character encoding from request object.
  * Enhanced performance for matching routes that share the same static prefix.
  * Fixed issue with child routes not passing route conditions to the Mapper.connect call.
  * Fixed documentation to reflect default value for minimization.
  * Allow backslash to escape special characters in route paths.
  * Resolve invalid escape sequences.
  * Remove support for Python 2.6, 3.3, and 3.4.
  * Remove obsolete Python 2.3 compat code.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1636372800">- add six dependency declaration</changelog>
  <changelog author="Ben Greiner &lt;code@bnavigator.de&gt;" date="1660824000">- Clean specfile, remove coverage</changelog>
  <changelog author="Mark&#xE9;ta Machov&#xE1; &lt;mmachova@suse.com&gt;" date="1717761600">- Add remove-six.patch to get rid of six</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1750766400">- Switch to pyproject macros.</changelog>
</package>
<package pkgid="b9c1f423f9a686e56d749eb2c85d7f519e514640b2dbe1f2600673f206000496562f4a3b9872a3345d95ce7a690185eac04748ee37d87ce4bbe278f67b991f5d" name="python314-asyncssh" arch="noarch">
  <version epoch="0" ver="2.23.1" rel="75.1"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1672920000">- update to 2.13.0:
  * Updated testing and coverage to drop Python 3.6 and add Python 3.11.
  * Added new "recv_eof" option to not pass an EOF from a channel to a
    redirected target, allowing output from multiple SSH sessions to be
    sent and mixed with other direct output to that target.
  * Added new methods to make it easy to perform forwarding between TCP
    ports and UNIX domain sockets.
  * Added a workaround for a problem seen on a Huawei SFTP server where
    it sends an invalid combination of file attribute flags.
  * Fixed an issue with copying files to SFTP servers that don't support
    random access I/O.
  * Fixed an issue when requesting remote port forwarding on a dynamically
    allocated port.
  * Fixed an issue where readexactly could block indefinitely when a signal
    is delivered in the stream before the requested number of bytes are
    available.
  * Fixed an interoperability issue with OpenSSH when using SSH certificates
    with RSA keys with a SHA-2 signature.
  * Fixed an issue with handling "None" in ProxyCommand, GlobalKnownHostsFile,
    and UserKnownHostsFile config file options.</changelog>
  <changelog author="Daniel Garcia &lt;daniel.garcia@suse.com&gt;" date="1674648000">- Add remove-sha1.patch to make it compatible with latests versions of
  cryptography gh#ronf/asyncssh@fae5a9e8baad</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1678104000">- update to 2.13.1:
  * Updated type definitions for mypy 1.0.0, removing a
    dependency on implicit Optional types, and working around an
    issue that could trigger a mypy internal error.
  * Updated unit tests to avoid calculation of SHA-1 signatures,
    which are no longer allowed in cryptography 39.0.0.
- drop remove-sha1.patch (upstream)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1688212800">- update to 2.13.2:
  * Fixed an issue with host-based authentication when using
    proxy_command, allowing it to be used if the caller
    explicitly specifies client_host.
  * Improved handling of signature algorithms for OpenSSH
    certificates so that RSA SHA-2 signatures will work with
    both older and newer versions of OpenSSH.
  * Worked around an issue with some Cisco SSH implementations
    generating invalid "ignore" packets.
  * Fixed unit tests to avoid errors when cryptography's version
    of * OpenSSL disables support for SHA-1 signatures.
  * Fixed unit tests to avoid errors when the filesystem enforces
    that filenames be valid UTF-8 strings.
  * Added documentation about which config options apply when
    passing a string as a tunnel argument.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1696507200">- update to 2.14.0:
  * Added support for a new accept_handler argument when setting
    up local port forwarding, allowing the client host and port to
    be validated and/or logged for each new forwarded connection.
  * Added an option to disable expensive RSA private key checks
    when using OpenSSL 3.x. Functions that read private keys have
    been modified to include a new unsafe_skip_rsa_key_validation
    argument which can be used to avoid these additional checks,
    if you are loading keys from a trusted source.
  * Added host information into AsyncSSH exceptions when host key
    validation fails, and a few other improvements related to
    X.509 certificate validation errors.
  * Fixed a regression which prevented keys loaded into an SSH
    agent with a certificate from working correctly beginning in
    AsyncSSH after version 2.5.0.
  * Fixed an issue which was triggering an internal exception
    when shutting down server sessions with the line editor enabled
    which could cause some output to be lost on exit, especially when
    running on Windows.
  * Fixed a documentation error in SSHClientConnectionOptions and
    SSHServerConnectionOptions.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1699617600">- update to 2.14.1 (bsc#1217028, CVE-2023-46445):
  * Hardened AsyncSSH state machine against potential message
    injection attacks, described in more detail in
    `CVE-2023-46445 and CVE-2023-46446
  * Added support for passing in a regex in readuntil in
    SSHReader,
  * Added support for get_addresses() and get_port() methods on
  * SSHAcceptor.
  * Fixed an issue with AsyncFileWriter potentially writing data
  * out of order.
  * Updated testing to include Python 3.12.
  * Updated readthedocs integration to use YAML config file.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1702900800">- update to 2.14.2 (bsc#1218165, CVE-2023-48795):
  * Implemented "strict kex" support and other countermeasures to
  * protect against the Terrapin Attack described in
    CVE-2023-48795
  * Fixed config parser to properly an optional equals delimiter
    in all config arguments.
  * Fixed TCP send error handling to avoid race condition when
    receiving incoming disconnect message.
  * Improved type signature in SSHConnection async context
    manager.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1723204800">- update to 2.15.0:
  * Added experimental support for tunneling of TUN/TAP network
    interfaces on Linux and macOS, allowing for either automatic
    packet forwarding or explicit reading and writing of packets
    sent through the tunnel by the application. Both callback and
    stream APIs are available.
  * Added support for forwarding terminal size and terminal size
    changes when stdin on an SSHServerProcess is redirected to a
    local TTY.
  * Added support for multiple tunnel/ProxyJump hosts. Thanks go
    to Adam Martin for suggesting this enhancement and proposing
    a solution.
  * Added support for OpenSSH lsetstat SFTP extension to set
    attributes on symbolic links on platforms which support that
    and use it to improve symlink handling in the SFTP get, put,
    and copy methods. In addition, a follow_symlinks option has
    been added on various SFTPClient methods which get and set
    these attributes. Thanks go to GitHub user eyalgolan1337 for
    reporting this issue.
  * Added support for password and passphrase arguments to be a
    callable or awaitable, called when performing authentication
    or loading encrypted private keys. Thanks go to GitHub user
    goblin for suggesting this enhancement.
  * Added support for proper flow control when using
    AsyncFileWriter or StreamWriter classes to do SSH process
    redirection. Thanks go to Benjy Wiener for reporting this
    issue and providing feedback on the fix.
  * Added is_closed() method
    SSHClientConnection/SSHServerConnection to return whether the
    associated network connection is closed or not.
  * Added support for setting and matching tags in OpenSSH config
    files.
  * Added an example of using "await" in addition to "async with"
    when opening a new SSHClientConnection. Thanks go to Michael
    Davis for suggesting this added documentation.
  * Improved handling CancelledError in SCP, avoiding an issue
    where AsyncSSH could sometimes get stuck waiting for the
    channel to close. Thanks go to Max Orlov for reporting the
    problem and providing code to reproduce it.
  * Fixed a regression from 2.14.1 related to rekeying an SSH
    connection when there's acitivty on the connection in the
    middle of rekeying. Thanks go to GitHub user eyalgolan1337
    for helping to narrow down this problem and test the fix.
  * Fixed a problem with process redirection when a close is
    received without a preceding EOF. Thanks go to GitHub user
    xuoguoto who helped to provide sample scripts and ran tests
    to help track this down.
  * Fixed the processing of paths in SFTP client symlink
    requests. Thanks go to André Glüpker for reporting the
    problem and providing test code to demonstrate it.
  * Fixed an OpenSSH config file parsing issue. Thanks go to
    Siddh Raman Pant for reporting this issue.
  * Worked around a bug in a user auth banner generated by the
    cryptlib library. Thanks go to GitHub user mmayomoar for
    reporting this issue and suggesting a fix.</changelog>
  <changelog author="Antonio Larrosa &lt;alarrosa@suse.com&gt;" date="1727352000">- update to 2.17.0:
  * Add support for specifying a per-connection credential store
    for GSSAPI authentication.
  * Fixed a regression introduced in AsyncSSH 2.15.0 which could
    cause connections to be closed with an uncaught exception when
    a session on the connection was closed.
  * Added a workaround where getaddrinfo() on some systems may
    return duplicate entries, causing bind() to fail when opening
    a listener.
  * Relaxed padding length check on OpenSSH private keys to
    provide better compatibility with keys generated by PuTTYgen.
  * Improved documentation on SSHClient and SSHServer classes to
    explain when they are created and their relationship to the
    SSHClientConnection and SSHServerConnection classes.
  * Updated examples to use Python 3.7 and made some minor
    improvements.
- update to 2.16.0:
  * Added client and server support for the OpenSSH "hostkeys"
    extension. When using known_hosts, clients can provide a
    handler which will be called with the changes between the
    keys currently trusted in the client's known hosts and those
    available on the server. On the server side, an application
    can choose whether or not to enable the sending of this host
    key information.
  * Related to the above, AsyncSSH now allows the configuration of
    multiple server host keys of the same type when the
    send_server_host_keys option is enabled. Only the first key of
    each type will be used in the SSH handshake, but the others can
    appear in the list of supported host keys for clients to begin
    trusting, allowing for smoother key rotation.
  * Fixed logging and typing issues in SFTP high-level copy
    functions. A mix of bytes, str, and PurePath entries are now
    supported in places where a list of file paths is allowed, and
    the type signatures have been updated to reflect that the
    functions accept either a single path or a list of paths.
  * Improved typing on SFTP listdir() function.
  * Reworked the config file parser to improve on a previous fix
    related to handling key/value pairs with an equals delimiter.
  * Improved handling of ciphers deprecated in cryptography 43.0.0.
  * Improved support for use of Windows pathnames in ProxyCommand.</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1730980800">- Update to 2.18.0
  * Added support for post-quantum ML-KEM key exchange algorithms,
    interoperable with OpenSSH 9.9.
  * Added support for the OpenSSH "limits" extension, allowing the
    client to query server limits such as the maximum supported read
    and write sizes. The client will automatically default to the reported
    maximum size on servers that support this extension.
  * Added more ways to specify environment variables via the `env` option.
    Sequences of either 'key=value' strings or (key, value) tuples are now
    supported, in addition to a dict.
  * Added support for getting/setting environment variables as byte strings
    on platforms which support it. Previously, only Unicode strings were
    accepted and they were always encoded on the wire using UTF-8.
  * Added support for non-TCP sockets (such as a socketpair) as the `sock`
    parameter in connect calls. Thanks go to Christian Wendt for reporting
    this problem and proposing a fix.
  * Changed compression to be disabled by default to avoid it becoming a
    performance bottleneck on high-bandwidth connections. This now also
    matches the OpenSSH default.
  * Improved speed of parallelized SFTP reads when read-ahead goes beyond
    the end of the file. Thanks go to Maximilian Knespel for reporting
    this issue and providing performance measurements on the code before
    and after the change.
  * Improved cancellation handling during SCP transfers.
  * Improved support for selecting the currently available security key
    when the application lists multiple keys to try. Thanks go to GitHub
    user zanda8893 for reporting the issue and helping to work out the
    details of the problem.
  * Improved handling of reverse DNS failures in host-based authentication.
    Thanks go to GitHub user xBiggs for suggesting this change.
  * Improved debug logging of byte strings with non-printable characters.
  * Switched to using an executor on GSSAPI calls to avoid blocking the
    event loop.
  * Fixed handling of "UserKnownHostsFile none" in config files. This
    previously caused it to use the default known hosts, rather than
    disabling known host checking.
  * Fixed a runtime warning about not awaiting a coroutine in unit tests.
  * Fixed a unit test failure on Windows when calling abort on a transport.
  * Fixed a problem where a "MAC verification failed" error was sometimes
    sent on connection close.
  * Fixed SSHClientProcess code to not raise a runtime exception when
    waiting more than once for a process to finish. Thanks go to GitHub
    user starflows for reporting this issue.
  * Handled an error when attempting to import older verions of pyOpenSSL.
    Thanks go to Maximilian Knespel for reporting this issue and testing
    the fix.
  * Updated simple_server example code to switch from crypt to bcrypt,
    since crypt has been removed in Python 3.13. Thanks go to Colin
    Watson for providing this update.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1749816000">- Switch to pyproject macros.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1752321600">- update to 2.21.0:
  * Added sparse file support for SFTP, allowing file copying
    which automatically skips over any "holes" in a source file,
    transferring only the data ranges which are actually present.
  * Added support for applications to request that session,
    connection, or TUN/TAP requests arriving on an
    SSHServerConnection be forwarded out some other established
    SSHClientConnection. Callback methods on SSHServer which
    decide how to handle these requests can now return an
    SSHClientConnection to set up this tunneling, instead of
    having to accept the request and implement their own
    forwarding logic.
  * Further hardened the SSH key exchange process to make
    AsyncSSH more strict when accepting messages during key
    exchange. Thanks go to Fabian Bäumer and Marcus Brinkmann for
    identifying potential issues here.
  * Added support for the auth_completed callback in SSHServer to
    be either a callable or a coroutine, allowing async
    operations to be performed when user authentication completes
    successfully, prior to accepting session requests.
  * Added support for the sftp_factory config argument be either
    a callable or a coroutine, allowing async operations to be
    performed when starting up a new SFTP server session.
  * Fixed a bug where the exit() method of SFTPServer didn't
    handle being declared as a coroutine. Thanks go to C. R.
    Oldham for reporting this issue.
  * Improved handling of exceptions in connection_lost()
    callbacks. Exceptions in connection_lost() will now be
    reported in the debug log, but other cleanup code in AsyncSSH
    will continue, ignoring those exceptions. Thanks go to Danil
    Slinchuk for reporting this issue.
  * Added support for specifying an explicit path when
    configuring agent forwarding. Thanks go to Aleksandr Ilin for
    pointing out that this options supports more than just a
    boolean value.
  * Added support for environment variable expansion in SSH
    config, for options which support percent expansion.
  * Added a new begin_auth callback in SSHClient, reporting the
    username being sent during SSH client authentication. This
    can be useful when the user is conditionally set via an SSH
    config file.
  * Improved strict-kex interoperability during re-keying. Thanks
    go to GitHub user emeryalden for reporting this issue and
    helping to track down the source of the problem.
  * Updated SFTP max_requests default to reduce memory usage when
    using large block sizes.
  * Updated testing to add Python 3.13 and drop Python 3.7,
    avoiding deprecation warnings from the cryptography package.
  * Fixed unit test issues under Windows, allowing unit tests to
    run on Windows on all supported versions of Python.
  * Fixed a couple of issues with Python 3.14. Thanks go to Georg
    Sauthoff for initially reporting this.
  * Added support for WebAuthN authentication with U2F security
    keys, allowing non-admin Windows users to use these keys for
    authentication. Previously, authentication with U2F keys
    worked on Windows, but only for admin users.
  * Added support for hostname canonicalization, compatible with
    the configuration parameters used in OpenSSH, as well as
    support for the "canonical" and "final" match keywords and
    negation support for match. Thanks go to GitHub user
    commonism who suggested this and provided a proposed
    implementation for negation.
  * Added client and server support for SFTP copy-data extension
    and a new SFTP remote_copy() function which allows data to be
    moved between two remote files without downloading and re-
    uploading the data. Thanks go to Ali Khosravi for suggesting
    this addition.
  * Moved project metadata from setup.py to pyproject.toml.
    Thanks go to Marc Mueller for contributing this.
  * Updated SSH connection to keep strong references to
    outstanding tasks, to avoid potential issues with the garbage
    collector while the connection is active. Thanks go to GitHub
    user Birnendampf for pointing out this potential issue and
    suggesting a simple fix.
  * Fixed some issues with block_size argument in SFTP copy
    functions. Thanks go to Krzysztof Kotlenga for finding and
    reporting these issues.
  * Fixed an import error when fido2 package wasn't available.
    Thanks go to GitHub user commonism for reporting this issue.</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1760011200">- Update to 2.21.1
  * Added the capability to defer invoking passphrase callback until
    an encrypted private key is actually used in a signing operation,
    rather than triggering the callback when keys are loaded. This
    will only work when a public key is provided with an encrypted
    private key either explicitly or as part of the key format (such
    as in OpenSSH's private key format).
  * Improved handling of KeyboardInterrupt and task cancellation in
    SCP. Thanks go to Viktor Kertesz for reporting this issue and
    helping to understand the behavior in various versions of Python.
  * Fixed the env option to support mappings other than dict. Thanks
    go to Boris Pavlovic for reporting this issue.
  * Fixed a potential race condition in SSHForwarder cleanup. Thanks
    go to GitHub user misa-hase for reporting this issue and helping
    to test the fix.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1760097600">- Add fido2-compat.patch to restore compatibility with python-fido2 &gt;= 2
- Update requirements from pyproject.toml</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1775217600">- update to 2.22.0:
  * Added a new config option utf8_decode_errors for handling
    UTF-8 decode errors when parsing certain fields in SSH
    packets (disconnect error, debug message, userauth banner,
    channel open failure reason, channel exit signal reason, and
    SFTP error reason). The default continues to behave as
    before, raising a ProtocolError exception, but this option
    allows invalid bytes to be removed or replaced. Thanks go to
    GitHub user Le-Syl21 for suggesting this.
  * Changed config parser to Ignore subdirectories and parse only
    plain files matching a glob pattern in include directives,
    better matching the behavior of other SSH implementations.
    Thanks go to Jacopo Nespolo for contributing this change.
  * Improved a previous fix for a race condition which sometimes
    triggered assertion errors in SSHForwarder. Thanks go to Mike
    Barry for reporting the issue and helping to test the
    improved fix.
  * Removed optional dependency on libnacl/libsodium for chacha20
    and Edwrds curves, now that these are available in all
    supported versions of the cryptography package.
  * Updated asyncssh to use version 2 of the fido2 package, and
    update minimum Python version to 3.10, required by that
    updated package.
  * Fixed issue with the OpenSSL legacy provider on Windows and
    re-enabled OpenSSL use in unit tests on Windows.
  * Inproved "run multiple clients" example to show the hostname
    being accessed by each task.
  * Added unit testing for Python 3.14 and dropped 3.8 and 3.9.
- drop fido2-compat.patch (upstream)</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1781611200">- Update to 2.23.1
  * Fixed an SCP path traversal issue.
  * Expanded previous fix to block unsafe user substitutions in server config.
  * Fixed default value for reuse_address and reuse_port, matching the
    behavior of asyncio.create_server().
- Update to 2.23.0 (fixes CVE-2026-45309, bsc#1268333)
  * Added support for "Match localnetwork".
  * Enabled support for RSA with SHA-2 signatures in ssh-agent and Pageant.
  * Changed MAC algorithm negotation to be skipped when using AEAD ciphers.
  * Improved graceful termination when using ProxyCommand, waiting for the
    ProxyCommand tunnel to close when cleaning up a connection.
  * Blocked unsafe user substitutions from being used in server config.
  * Fixed an issue with config evaluation when "Match final" was combined
    with Hostname directives.
  * Fixed a resource leak in xauth support.
  * Fixed issue with multi-hop ProxyJump directives in a config file not
    working correctly.
  * Fixed string encoding in SFTPName objects returned by realpath().</changelog>
</package>
<package pkgid="bed6a6969114da103b69afe794e6e2ba915dc49fd9ba1d1df9626ce189131d9a34ff4e25bd2f3696a9a92dd34a5edc5dab4a9c9a16afe832afc418d97fa42f80" name="python314-cffi" arch="aarch64">
  <version epoch="0" ver="2.0.0" rel="117.10"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1673006400">- add 8a3c2c816d789639b49d3ae867213393ed7abdff.patch to resolve
  testsuite failures with Python 3.11</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1681387200">- Make calling of %{sle15modernpython} optional.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1682078400">- add sle15_python_module_pythons (jsc#PED-68)</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1696593600">- Clean up the SPEC file</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1696593601">- Upgrade to 1.16.0:
  - Add support for Python 3.12. With the removal of distutils
    from Python 3.12, projects using CFFI features that depend on
    distutils at runtime must add a dependency on setuptools to
    function under Python 3.12+. CFFI does not declare a runtime
    setuptools requirement to avoid an unnecessary dependency for
    projects that do not require it.
  - Drop support for end-of-life Python versions (2.7, 3.6, 3.7).
  - Move project source under src/; a more standard layout that
    also enables CI to more easily catch packaging errors.
  - Move project home to python-cffi/cffi on GitHub.
  - Add support for PEP517 builds; setuptools is now a required
    build dependency.
  - Declare python_requires metadata for Python 3.8+. This allows
    unsupported Pythons to continue using previously released
    sdists and wheels.
  - Add missing calls to PyObject_GC_UnTrack to avoid
    ResourceWarning 15c4b71
- Remove upstreamed patch
  8a3c2c816d789639b49d3ae867213393ed7abdff.patch</changelog>
  <changelog author="Dan &#x10C;erm&#xE1;k &lt;dcermak@suse.com&gt;" date="1709208000">- drop unnecessary buildrequire python-py</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1719748800">- add py313-compat.patch
  py313-use-format-unraisable.patch
  py313-use-hashpointer.patch: add upstream patches for py3.13
  support</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1725105600">- update to 1.17.0:
  * Add support for Python 3.13.
  * In API mode, when you get a function from a C library by writing
    `fn = lib.myfunc`, you get an object of a special type for
    performance reasons, instead of a `&lt;cdata 'C-function-type'&gt;`.
    Before version 1.17 you could only call such objects.
    You could write `ffi.addressof(lib, "myfunc")` in order to get
    a real `&lt;cdata&gt;` object, based on the idea that in these cases
    in C you'd usually write `&amp;myfunc` instead of `myfunc`.  In
    version 1.17, the special object `lib.myfunc` can now be passed
    in many places where CFFI expects
    a regular `&lt;cdata&gt;` object.  For example, you can now pass
    it as a callback to a C function call, or write it inside a C
    structure field of the correct pointer-to-function type, or use
    `ffi.cast()` or `ffi.typeof()` on it.
- drop py313-compat.patch, py313-use-format-unraisable.patch,
  py313-use-hashpointer.patch (upstream)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1728475200">- update to 1.17.1:
  * Fix failing distutils.msvc9compiler imports under Windows (#118).
  * ffibuilder.emit_python_code() and ffibuiler.emit_c_code()
    accept file-like objects (#115).
  * ffiplatform calls are bypassed by ffibuilder.emit_python_code()
    and ffibuilder.emit_c_code() (#81).</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1757851200">- update to 2.0.0:
  * Added support for free threaded CPython (3.14t+ only)
  * Added support for Python 3.14.
  * Dropped support for Python 3.8.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1773662400">- Add patch support-pycparser-3.patch:
  * Support pycparser 3 exception message changes.</changelog>
</package>
<package pkgid="47fc1cf47f9f8d95163a60b8df7c1089fd7b0478bdfecfd2f397fc2b8034bbe0852a689fbe353917eab9903ea36a9726b68b9a4f4115b124a004693c150d636d" name="python314-cffi" arch="armv7hl">
  <version epoch="0" ver="2.0.0" rel="117.10"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1673006400">- add 8a3c2c816d789639b49d3ae867213393ed7abdff.patch to resolve
  testsuite failures with Python 3.11</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1681387200">- Make calling of %{sle15modernpython} optional.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1682078400">- add sle15_python_module_pythons (jsc#PED-68)</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1696593600">- Clean up the SPEC file</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1696593601">- Upgrade to 1.16.0:
  - Add support for Python 3.12. With the removal of distutils
    from Python 3.12, projects using CFFI features that depend on
    distutils at runtime must add a dependency on setuptools to
    function under Python 3.12+. CFFI does not declare a runtime
    setuptools requirement to avoid an unnecessary dependency for
    projects that do not require it.
  - Drop support for end-of-life Python versions (2.7, 3.6, 3.7).
  - Move project source under src/; a more standard layout that
    also enables CI to more easily catch packaging errors.
  - Move project home to python-cffi/cffi on GitHub.
  - Add support for PEP517 builds; setuptools is now a required
    build dependency.
  - Declare python_requires metadata for Python 3.8+. This allows
    unsupported Pythons to continue using previously released
    sdists and wheels.
  - Add missing calls to PyObject_GC_UnTrack to avoid
    ResourceWarning 15c4b71
- Remove upstreamed patch
  8a3c2c816d789639b49d3ae867213393ed7abdff.patch</changelog>
  <changelog author="Dan &#x10C;erm&#xE1;k &lt;dcermak@suse.com&gt;" date="1709208000">- drop unnecessary buildrequire python-py</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1719748800">- add py313-compat.patch
  py313-use-format-unraisable.patch
  py313-use-hashpointer.patch: add upstream patches for py3.13
  support</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1725105600">- update to 1.17.0:
  * Add support for Python 3.13.
  * In API mode, when you get a function from a C library by writing
    `fn = lib.myfunc`, you get an object of a special type for
    performance reasons, instead of a `&lt;cdata 'C-function-type'&gt;`.
    Before version 1.17 you could only call such objects.
    You could write `ffi.addressof(lib, "myfunc")` in order to get
    a real `&lt;cdata&gt;` object, based on the idea that in these cases
    in C you'd usually write `&amp;myfunc` instead of `myfunc`.  In
    version 1.17, the special object `lib.myfunc` can now be passed
    in many places where CFFI expects
    a regular `&lt;cdata&gt;` object.  For example, you can now pass
    it as a callback to a C function call, or write it inside a C
    structure field of the correct pointer-to-function type, or use
    `ffi.cast()` or `ffi.typeof()` on it.
- drop py313-compat.patch, py313-use-format-unraisable.patch,
  py313-use-hashpointer.patch (upstream)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1728475200">- update to 1.17.1:
  * Fix failing distutils.msvc9compiler imports under Windows (#118).
  * ffibuilder.emit_python_code() and ffibuiler.emit_c_code()
    accept file-like objects (#115).
  * ffiplatform calls are bypassed by ffibuilder.emit_python_code()
    and ffibuilder.emit_c_code() (#81).</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1757851200">- update to 2.0.0:
  * Added support for free threaded CPython (3.14t+ only)
  * Added support for Python 3.14.
  * Dropped support for Python 3.8.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1773662400">- Add patch support-pycparser-3.patch:
  * Support pycparser 3 exception message changes.</changelog>
</package>
<package pkgid="fe110aea344c716e1256e3e0be248611f4ab73648e990ff6ad85d4918617a801a038a6444ba4ea22622de8322b73ce33dde7be2d24fa8048de05c166ebcd31e8" name="python314-cffi" arch="x86_64">
  <version epoch="0" ver="2.0.0" rel="117.10"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1673006400">- add 8a3c2c816d789639b49d3ae867213393ed7abdff.patch to resolve
  testsuite failures with Python 3.11</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1681387200">- Make calling of %{sle15modernpython} optional.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1682078400">- add sle15_python_module_pythons (jsc#PED-68)</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1696593600">- Clean up the SPEC file</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1696593601">- Upgrade to 1.16.0:
  - Add support for Python 3.12. With the removal of distutils
    from Python 3.12, projects using CFFI features that depend on
    distutils at runtime must add a dependency on setuptools to
    function under Python 3.12+. CFFI does not declare a runtime
    setuptools requirement to avoid an unnecessary dependency for
    projects that do not require it.
  - Drop support for end-of-life Python versions (2.7, 3.6, 3.7).
  - Move project source under src/; a more standard layout that
    also enables CI to more easily catch packaging errors.
  - Move project home to python-cffi/cffi on GitHub.
  - Add support for PEP517 builds; setuptools is now a required
    build dependency.
  - Declare python_requires metadata for Python 3.8+. This allows
    unsupported Pythons to continue using previously released
    sdists and wheels.
  - Add missing calls to PyObject_GC_UnTrack to avoid
    ResourceWarning 15c4b71
- Remove upstreamed patch
  8a3c2c816d789639b49d3ae867213393ed7abdff.patch</changelog>
  <changelog author="Dan &#x10C;erm&#xE1;k &lt;dcermak@suse.com&gt;" date="1709208000">- drop unnecessary buildrequire python-py</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1719748800">- add py313-compat.patch
  py313-use-format-unraisable.patch
  py313-use-hashpointer.patch: add upstream patches for py3.13
  support</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1725105600">- update to 1.17.0:
  * Add support for Python 3.13.
  * In API mode, when you get a function from a C library by writing
    `fn = lib.myfunc`, you get an object of a special type for
    performance reasons, instead of a `&lt;cdata 'C-function-type'&gt;`.
    Before version 1.17 you could only call such objects.
    You could write `ffi.addressof(lib, "myfunc")` in order to get
    a real `&lt;cdata&gt;` object, based on the idea that in these cases
    in C you'd usually write `&amp;myfunc` instead of `myfunc`.  In
    version 1.17, the special object `lib.myfunc` can now be passed
    in many places where CFFI expects
    a regular `&lt;cdata&gt;` object.  For example, you can now pass
    it as a callback to a C function call, or write it inside a C
    structure field of the correct pointer-to-function type, or use
    `ffi.cast()` or `ffi.typeof()` on it.
- drop py313-compat.patch, py313-use-format-unraisable.patch,
  py313-use-hashpointer.patch (upstream)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1728475200">- update to 1.17.1:
  * Fix failing distutils.msvc9compiler imports under Windows (#118).
  * ffibuilder.emit_python_code() and ffibuiler.emit_c_code()
    accept file-like objects (#115).
  * ffiplatform calls are bypassed by ffibuilder.emit_python_code()
    and ffibuilder.emit_c_code() (#81).</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1757851200">- update to 2.0.0:
  * Added support for free threaded CPython (3.14t+ only)
  * Added support for Python 3.14.
  * Dropped support for Python 3.8.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1773662400">- Add patch support-pycparser-3.patch:
  * Support pycparser 3 exception message changes.</changelog>
</package>
<package pkgid="097450eae6be8e942ae28aac0375a71ed5724be8c00c8317cb4de5be74bc39ad963f2ff7478b2210adcefef9f2f7563d980feeb18210a357a0c281eb03ce1f88" name="python314-cffi-debuginfo" arch="aarch64">
  <version epoch="0" ver="2.0.0" rel="117.10"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1673006400">- add 8a3c2c816d789639b49d3ae867213393ed7abdff.patch to resolve
  testsuite failures with Python 3.11</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1681387200">- Make calling of %{sle15modernpython} optional.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1682078400">- add sle15_python_module_pythons (jsc#PED-68)</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1696593600">- Clean up the SPEC file</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1696593601">- Upgrade to 1.16.0:
  - Add support for Python 3.12. With the removal of distutils
    from Python 3.12, projects using CFFI features that depend on
    distutils at runtime must add a dependency on setuptools to
    function under Python 3.12+. CFFI does not declare a runtime
    setuptools requirement to avoid an unnecessary dependency for
    projects that do not require it.
  - Drop support for end-of-life Python versions (2.7, 3.6, 3.7).
  - Move project source under src/; a more standard layout that
    also enables CI to more easily catch packaging errors.
  - Move project home to python-cffi/cffi on GitHub.
  - Add support for PEP517 builds; setuptools is now a required
    build dependency.
  - Declare python_requires metadata for Python 3.8+. This allows
    unsupported Pythons to continue using previously released
    sdists and wheels.
  - Add missing calls to PyObject_GC_UnTrack to avoid
    ResourceWarning 15c4b71
- Remove upstreamed patch
  8a3c2c816d789639b49d3ae867213393ed7abdff.patch</changelog>
  <changelog author="Dan &#x10C;erm&#xE1;k &lt;dcermak@suse.com&gt;" date="1709208000">- drop unnecessary buildrequire python-py</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1719748800">- add py313-compat.patch
  py313-use-format-unraisable.patch
  py313-use-hashpointer.patch: add upstream patches for py3.13
  support</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1725105600">- update to 1.17.0:
  * Add support for Python 3.13.
  * In API mode, when you get a function from a C library by writing
    `fn = lib.myfunc`, you get an object of a special type for
    performance reasons, instead of a `&lt;cdata 'C-function-type'&gt;`.
    Before version 1.17 you could only call such objects.
    You could write `ffi.addressof(lib, "myfunc")` in order to get
    a real `&lt;cdata&gt;` object, based on the idea that in these cases
    in C you'd usually write `&amp;myfunc` instead of `myfunc`.  In
    version 1.17, the special object `lib.myfunc` can now be passed
    in many places where CFFI expects
    a regular `&lt;cdata&gt;` object.  For example, you can now pass
    it as a callback to a C function call, or write it inside a C
    structure field of the correct pointer-to-function type, or use
    `ffi.cast()` or `ffi.typeof()` on it.
- drop py313-compat.patch, py313-use-format-unraisable.patch,
  py313-use-hashpointer.patch (upstream)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1728475200">- update to 1.17.1:
  * Fix failing distutils.msvc9compiler imports under Windows (#118).
  * ffibuilder.emit_python_code() and ffibuiler.emit_c_code()
    accept file-like objects (#115).
  * ffiplatform calls are bypassed by ffibuilder.emit_python_code()
    and ffibuilder.emit_c_code() (#81).</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1757851200">- update to 2.0.0:
  * Added support for free threaded CPython (3.14t+ only)
  * Added support for Python 3.14.
  * Dropped support for Python 3.8.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1773662400">- Add patch support-pycparser-3.patch:
  * Support pycparser 3 exception message changes.</changelog>
</package>
<package pkgid="9c81b53529713835b5a6cf0c8a580f8eed28b53d812d3aa4a024b9995664925c9fe67a87bd4969e098bacddaa206146af9127bd20bedc8da978dec2dca2419ed" name="python314-cffi-debuginfo" arch="armv7hl">
  <version epoch="0" ver="2.0.0" rel="117.10"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1673006400">- add 8a3c2c816d789639b49d3ae867213393ed7abdff.patch to resolve
  testsuite failures with Python 3.11</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1681387200">- Make calling of %{sle15modernpython} optional.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1682078400">- add sle15_python_module_pythons (jsc#PED-68)</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1696593600">- Clean up the SPEC file</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1696593601">- Upgrade to 1.16.0:
  - Add support for Python 3.12. With the removal of distutils
    from Python 3.12, projects using CFFI features that depend on
    distutils at runtime must add a dependency on setuptools to
    function under Python 3.12+. CFFI does not declare a runtime
    setuptools requirement to avoid an unnecessary dependency for
    projects that do not require it.
  - Drop support for end-of-life Python versions (2.7, 3.6, 3.7).
  - Move project source under src/; a more standard layout that
    also enables CI to more easily catch packaging errors.
  - Move project home to python-cffi/cffi on GitHub.
  - Add support for PEP517 builds; setuptools is now a required
    build dependency.
  - Declare python_requires metadata for Python 3.8+. This allows
    unsupported Pythons to continue using previously released
    sdists and wheels.
  - Add missing calls to PyObject_GC_UnTrack to avoid
    ResourceWarning 15c4b71
- Remove upstreamed patch
  8a3c2c816d789639b49d3ae867213393ed7abdff.patch</changelog>
  <changelog author="Dan &#x10C;erm&#xE1;k &lt;dcermak@suse.com&gt;" date="1709208000">- drop unnecessary buildrequire python-py</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1719748800">- add py313-compat.patch
  py313-use-format-unraisable.patch
  py313-use-hashpointer.patch: add upstream patches for py3.13
  support</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1725105600">- update to 1.17.0:
  * Add support for Python 3.13.
  * In API mode, when you get a function from a C library by writing
    `fn = lib.myfunc`, you get an object of a special type for
    performance reasons, instead of a `&lt;cdata 'C-function-type'&gt;`.
    Before version 1.17 you could only call such objects.
    You could write `ffi.addressof(lib, "myfunc")` in order to get
    a real `&lt;cdata&gt;` object, based on the idea that in these cases
    in C you'd usually write `&amp;myfunc` instead of `myfunc`.  In
    version 1.17, the special object `lib.myfunc` can now be passed
    in many places where CFFI expects
    a regular `&lt;cdata&gt;` object.  For example, you can now pass
    it as a callback to a C function call, or write it inside a C
    structure field of the correct pointer-to-function type, or use
    `ffi.cast()` or `ffi.typeof()` on it.
- drop py313-compat.patch, py313-use-format-unraisable.patch,
  py313-use-hashpointer.patch (upstream)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1728475200">- update to 1.17.1:
  * Fix failing distutils.msvc9compiler imports under Windows (#118).
  * ffibuilder.emit_python_code() and ffibuiler.emit_c_code()
    accept file-like objects (#115).
  * ffiplatform calls are bypassed by ffibuilder.emit_python_code()
    and ffibuilder.emit_c_code() (#81).</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1757851200">- update to 2.0.0:
  * Added support for free threaded CPython (3.14t+ only)
  * Added support for Python 3.14.
  * Dropped support for Python 3.8.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1773662400">- Add patch support-pycparser-3.patch:
  * Support pycparser 3 exception message changes.</changelog>
</package>
<package pkgid="5a33a4a9ef8cd760641e2b42fd98829cdf6b726dfc29ea4c5622dbb13a27b6c06b1e6ae473d60741865391e85b1cb120ffc5a579344aa737eaf71b3ece6aa656" name="python314-cffi-debuginfo" arch="x86_64">
  <version epoch="0" ver="2.0.0" rel="117.10"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1673006400">- add 8a3c2c816d789639b49d3ae867213393ed7abdff.patch to resolve
  testsuite failures with Python 3.11</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1681387200">- Make calling of %{sle15modernpython} optional.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1682078400">- add sle15_python_module_pythons (jsc#PED-68)</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1696593600">- Clean up the SPEC file</changelog>
  <changelog author="Matej Cepl &lt;mcepl@cepl.eu&gt;" date="1696593601">- Upgrade to 1.16.0:
  - Add support for Python 3.12. With the removal of distutils
    from Python 3.12, projects using CFFI features that depend on
    distutils at runtime must add a dependency on setuptools to
    function under Python 3.12+. CFFI does not declare a runtime
    setuptools requirement to avoid an unnecessary dependency for
    projects that do not require it.
  - Drop support for end-of-life Python versions (2.7, 3.6, 3.7).
  - Move project source under src/; a more standard layout that
    also enables CI to more easily catch packaging errors.
  - Move project home to python-cffi/cffi on GitHub.
  - Add support for PEP517 builds; setuptools is now a required
    build dependency.
  - Declare python_requires metadata for Python 3.8+. This allows
    unsupported Pythons to continue using previously released
    sdists and wheels.
  - Add missing calls to PyObject_GC_UnTrack to avoid
    ResourceWarning 15c4b71
- Remove upstreamed patch
  8a3c2c816d789639b49d3ae867213393ed7abdff.patch</changelog>
  <changelog author="Dan &#x10C;erm&#xE1;k &lt;dcermak@suse.com&gt;" date="1709208000">- drop unnecessary buildrequire python-py</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1719748800">- add py313-compat.patch
  py313-use-format-unraisable.patch
  py313-use-hashpointer.patch: add upstream patches for py3.13
  support</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1725105600">- update to 1.17.0:
  * Add support for Python 3.13.
  * In API mode, when you get a function from a C library by writing
    `fn = lib.myfunc`, you get an object of a special type for
    performance reasons, instead of a `&lt;cdata 'C-function-type'&gt;`.
    Before version 1.17 you could only call such objects.
    You could write `ffi.addressof(lib, "myfunc")` in order to get
    a real `&lt;cdata&gt;` object, based on the idea that in these cases
    in C you'd usually write `&amp;myfunc` instead of `myfunc`.  In
    version 1.17, the special object `lib.myfunc` can now be passed
    in many places where CFFI expects
    a regular `&lt;cdata&gt;` object.  For example, you can now pass
    it as a callback to a C function call, or write it inside a C
    structure field of the correct pointer-to-function type, or use
    `ffi.cast()` or `ffi.typeof()` on it.
- drop py313-compat.patch, py313-use-format-unraisable.patch,
  py313-use-hashpointer.patch (upstream)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1728475200">- update to 1.17.1:
  * Fix failing distutils.msvc9compiler imports under Windows (#118).
  * ffibuilder.emit_python_code() and ffibuiler.emit_c_code()
    accept file-like objects (#115).
  * ffiplatform calls are bypassed by ffibuilder.emit_python_code()
    and ffibuilder.emit_c_code() (#81).</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1757851200">- update to 2.0.0:
  * Added support for free threaded CPython (3.14t+ only)
  * Added support for Python 3.14.
  * Dropped support for Python 3.8.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1773662400">- Add patch support-pycparser-3.patch:
  * Support pycparser 3 exception message changes.</changelog>
</package>
<package pkgid="ab8fdf3388c08e8a0a08845034c44ee791877d63cc687bb935e30189c3dacd048360793be70258d4abbbc2667bf4fa927259af3e5cc8d20ba6fa6b91cba7195e" name="python314-cryptography" arch="aarch64">
  <version epoch="0" ver="49.0.0" rel="289.3"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1727524800">- update to 43.0.1:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.3.2.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1729598400">- update to 43.0.3:
  * Fixed release metadata for cryptography-vectors
  * Fixed compilation when using LibreSSL 4.0.0.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1730808000">- Avoid using requires_eq, which after the last modifications
  conflicts with python singlespec (order of expansion).</changelog>
  <changelog author="Ben Greiner &lt;code@bnavigator.de&gt;" date="1731067200">- Fix requires_eq replacement for distributions which do not have
  python3-cffi installed (such as SLE15 python module pythons)
  * gh#openSUSE/python-rpm-macros#185
- Remove outdated section in description</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfyhalomacro@opensuse.org&gt;" date="1737892800">- Update to version 44.0.0:
  * BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL &lt; 3.9.
  * Deprecated Python 3.7 support. Python 3.7 is no longer supported by
    the Python core team. Support for Python 3.7 will be removed in a future
    cryptography release.
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.4.0.
  * macOS wheels are now built against the macOS 10.13 SDK. Users on older
    versions of macOS should upgrade, or they will need to build cryptography
    themselves.
  * Enforce the RFC 5280 requirement that extended key usage extensions must not be empty.
  * Added support for timestamp extraction to the :class:`~cryptography.fernet.MultiFernet` class.
  * Relax the Authority Key Identifier requirements on root CA certificates
    during X.509 verification to allow fields permitted by RFC 5280 but
    forbidden by the CA/Browser BRs.
  * Added support for
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2id` when using
    OpenSSL 3.2.0+.
  * Added support for the :class:`~cryptography.x509.Admissions` certificate extension.
  * Added basic support for PKCS7 decryption (including S/MIME 3.2) via
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der`,
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_pem`,
    and :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_smime`.
- Update specfile to accommodate new project structure at version 44.0.0
- Update no-pytest_benchmark.patch</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1740571200">- update to 44.0.1:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.4.1.
  * We now build armv7l manylinux wheels and publish them to
    PyPI.
  * We now build manylinux_2_34 wheels and publish them to PyPI.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1742731200">- update to 44.0.2:
  * We now build wheels for PyPy 3.11.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1746619200">- Update to 44.0.3
  * Fixed compilation when using LibreSSL 4.1.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1752321600">- update to 45.0.5:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.1.
  * Fixed decrypting PKCS#8 files encrypted with SHA1-RC4. (This
    is not considered secure, and is supported only for backwards
    compatibility.)
  * Fixed decrypting PKCS#8 files encrypted with long salts (this
    impacts keys encrypted by Bouncy Castle).
  * Fixed decrypting PKCS#8 files encrypted with DES-CBC-MD5.
    While wildly insecure, this remains prevalent.
  * Fixed using mypy with cryptography on older versions of
    Python.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.0.
  * Support for Python 3.7 is deprecated and will be removed in
    the next cryptography release.
  * Updated the minimum supported Rust version (MSRV) to 1.74.0,
    from 1.65.0.
  * Added support for serialization of PKCS#12 Java truststores
    in :func:`~cryptography.hazmat.primitives.serialization.pkcs1
    2.serialize_java_truststore`
  * Added :meth:`~cryptography.hazmat.primitives.kdf.argon2.Argon
    2id.derive_phc_encoded` and :meth:`~cryptography.hazmat.primi
    tives.kdf.argon2.Argon2id.verify_phc_encoded` methods to
    support password hashing in the PHC string format
  * Added support for PKCS7 decryption and encryption using
    AES-256 as the content algorithm, in addition to AES-128.
  * BACKWARDS INCOMPATIBLE: Made SSH private key loading more
    consistent with other private key loading: :func:`~cryptograp
    hy.hazmat.primitives.serialization.load_ssh_private_key` now
    raises a TypeError if the key is unencrypted but a password
    is provided (previously no exception was raised), and raises
    a TypeError if the key is encrypted but no password is
    provided (previously a ValueError was raised).
  * Added __copy__ to the :class:`~cryptography.hazmat.primitives
    .asymmetric.ec.EllipticCurvePrivateKey`, :class:`~cryptograph
    y.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey`, :c
    lass:`~cryptography.hazmat.primitives.asymmetric.ed25519.Ed25
    519PublicKey`, :class:`~cryptography.hazmat.primitives.asymme
    tric.ed25519.Ed25519PrivateKey`, :class:`~cryptography.hazmat
    .primitives.asymmetric.ed448.Ed448PublicKey`, :class:`~crypto
    graphy.hazmat.primitives.asymmetric.ed448.Ed448PrivateKey`, :
    class:`~cryptography.hazmat.primitives.asymmetric.x25519.X255
    19PublicKey`, :class:`~cryptography.hazmat.primitives.asymmet
    ric.x25519.X25519PrivateKey`, :class:`~cryptography.hazmat.pr
    imitives.asymmetric.x448.X448PublicKey`, :class:`~cryptograph
    y.hazmat.primitives.asymmetric.x448.X448PrivateKey`, :class:`
    ~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey`
    , :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAP
    ublicKey`, :class:`~cryptography.hazmat.primitives.asymmetric
    .dsa.DSAPrivateKey`, :class:`~cryptography.hazmat.primitives.
    asymmetric.dsa.DSAPublicKey`, :class:`~cryptography.hazmat.pr
    imitives.asymmetric.dh.DHPrivateKey`, and :class:`~cryptograp
    hy.hazmat.primitives.asymmetric.dh.DHPublicKey` abstract base
    classes.
  * We significantly refactored how private key loading ( :func:`
    ~cryptography.hazmat.primitives.serialization.load_pem_privat
    e_key` and :func:`~cryptography.hazmat.primitives.serializati
    on.load_der_private_key`) works. This is intended to be
    backwards compatible for all well-formed keys, therefore if
    you discover a key that now raises an exception, please file
    a bug with instructions for reproducing.
  * Added unsafe_skip_rsa_key_validation keyword-argument to :fun
    c:`~cryptography.hazmat.primitives.serialization.load_ssh_pri
    vate_key`.
  * Added :class:`~cryptography.hazmat.primitives.hashes.XOFHash`
    to support repeated :meth:`~cryptography.hazmat.primitives.ha
    shes.XOFHash.squeeze` operations on extendable output
    functions.
  * Added :meth:`~cryptography.x509.ocsp.OCSPResponseBuilder.add_
    response_by_hash` method to allow creating OCSP responses
    using certificate hash values rather than full certificates.
  * Extended the :mod:`X.509 path validation
    &lt;cryptography.x509.verification&gt;` API to support user-
    configured extension policies via the
    :meth:`PolicyBuilder.extension_policies &lt;cryptography.x509.ve
    rification.PolicyBuilder.extension_policies&gt;` method.
  * Deprecated the subject, verification_time and max_chain_depth
    properties on
    :class:`~cryptography.x509.verification.ClientVerifier` and
    :class:`~cryptography.x509.verification.ServerVerifier` in
    favor of a new policy property. These properties will be
    removed in the next release of cryptography.
  * BACKWARDS INCOMPATIBLE: The :meth:`VerifiedClient.subject
    &lt;cryptography.x509.verification.VerifiedClient.subjects&gt;`
    property can now be None since a custom extension policy may
    allow certificates without a Subject Alternative Name
    extension.
  * Changed the behavior when the OpenSSL 3 legacy provider fails
    to load. Instead of raising an exception, a warning is now
    emitted. The CRYPTOGRAPHY_OPENSSL_NO_LEGACY environment
    variable can still be used to disable the legacy provider at
    runtime.
  * Added support for the CRYPTOGRAPHY_BUILD_OPENSSL_NO_LEGACY
    environment variable during build time, which prevents the
    library from ever attempting to load the legacy provider.
  * Added support for the
    :class:`~cryptography.x509.PrivateKeyUsagePeriod` X.509
    extension. This extension defines the period during which the
    private key corresponding to the certificate's public key may
    be used.
  * Added support for compiling against `aws-lc`_.
  * Parsing X.509 structures now more strictly enforces that Name
    structures do not have malformed ASN.1.
  * We now publish py311 wheels that utilize the faster
    pyo3::buffer::PyBuffer interface, resulting in significantly
    improved performance for operations involving small buffers.
  * Added :func:`~cryptography.hazmat.primitives.serialization.ss
    h_key_fingerprint` for computing fingerprints of SSH public
    keys.
  * Added support for deterministic ECDSA signing via the new
    keyword-only argument ecdsa_deterministic in
    :meth:`~cryptography.x509.CertificateBuilder.sign`, :meth:`~c
    ryptography.x509.CertificateRevocationListBuilder.sign` and :
    meth:`~cryptography.x509.CertificateSigningRequestBuilder.sig
    n`.</changelog>
  <changelog author="James Oakley &lt;jfunk@opensuse.org&gt;" date="1756728000">- Add Make-unsafe-subinterpreter-support-available-via-cfg.patch
  to allow ceph-mgr to load modules (boo#1248987)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1757851200">- update to 45.0.7:
  * Added a function to support an upcoming pyOpenSSL release.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1760356800">- update to 46.0.2:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.4.
  * Fixed an issue where users installing via pip on Python 3.14
    development versions would not properly install a dependency.
  * Fixed an issue building the free-threaded macOS 3.14 wheels.
  * BACKWARDS INCOMPATIBLE: Support for Python 3.7 has been
    removed.
  * Support for OpenSSL &lt; 3.0 is deprecated and will be removed
    in the next release.
  * Support for x86_64 macOS (including publishing wheels) is
    deprecated and will be removed in two releases. We will
    switch to publishing an arm64 only wheel for macOS.
  * Support for 32-bit Windows (including publishing wheels) is
    deprecated and will be removed in two releases. Users should
    move to a 64-bit Python installation.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.3.
  * We now build ppc64le manylinux wheels and publish them to
    PyPI.
  * We now build win_arm64 (Windows on Arm) wheels and publish
    them to PyPI.
  * Added support for free-threaded Python 3.14.
  * Removed the deprecated get_attribute_for_oid method on
    :class:`~cryptography.x509.CertificateSigningRequest`. Users
    should use
    :meth:`~cryptography.x509.Attributes.get_attribute_for_oid`
    instead.
  * Removed the deprecated CAST5, SEED, IDEA, and Blowfish
    classes from the cipher module. These are still available in
    :doc:`/hazmat/decrepit/index`.
  * In X.509, when performing a PSS signature with a SHA-3 hash,
    it is now encoded with the official NIST SHA3 OID.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1765195200">- Only require pytest-subtests with pytest &lt; 9.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1770897600">- Update to 46.0.5 (fixes CVE-2026-26007, bsc#1258074)
  * An attacker could create a malicious public key that reveals portions of
    your private key when using certain uncommon elliptic curves (binary
    curves). This version now includes additional security checks to prevent
    this attack. This issue only affects binary elliptic curves, which are
    rarely used in real-world applications. Credit to XlabAI Team of Tencent
    Xuanwu Lab and Atuin Automated Vulnerability Discovery Engine for reporting
    the issue. CVE-2026-26007
  * Support for SECT* binary elliptic curves is deprecated and will be removed
    in the next release.
- Update to 46.0.4
  * Dropped support for win_arm64 wheels.
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.5.
- Update to 46.0.3
  * Fixed compilation when using LibreSSL 4.2.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1774612800">- update to 46.0.6 (CVE-2026-34073, bsc#1260876):
  * SECURITY ISSUE: Fixed a bug where name constraints were not
    applied to peer names during verification when the leaf
    certificate contains a wildcard DNS SAN. Ordinary X.509
    topologies are not affected by this bug, including those used
    by the Web PKI. Credit to Oleh Konko (1seal) for reporting
    the issue. CVE-2026-34073</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1774958400">- Add patch support-maturin-1.12.patch:
  * Correctly deal with maturin bugfix that installs tests and
    docs under sitearch.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1775822400">- Update to 46.0.7 (fixes CVE-2026-39892, bsc#1261863)
  * **SECURITY ISSUE**: Fixed an issue where non-contiguous buffers could be
    passed to APIs that accept Python buffers, which could lead to buffer
    overflow. **CVE-2026-39892**
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.6.
- drop support-maturin-1.12.patch (upstream)
- drop no-pytest_benchmark.patch,
  Make-unsafe-subinterpreter-support-available-via-cfg.patch:
  obsolete</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1777204800">- update to 47.0.0:
  * Support for Python 3.8 is deprecated and will be removed in
    the next cryptography release.
  * BACKWARDS INCOMPATIBLE: Support for binary elliptic curves
    (SECT* classes) has been removed. These curves are rarely
    used and have additional security considerations that make
    them undesirable.
  * BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.1.x has been
    removed. OpenSSL 3.0.0 or later is now required. LibreSSL,
    BoringSSL, and AWS-LC continue to be supported.
  * BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL &lt; 4.1.
  * BACKWARDS INCOMPATIBLE: Loading keys with unsupported
    algorithms or keys with unsupported explicit curve encodings
    now raises
    :class:`~cryptography.exceptions.UnsupportedAlgorithm`
    instead of ValueError. This change affects :func:`~cryptograp
    hy.hazmat.primitives.serialization.load_pem_private_key`, :fu
    nc:`~cryptography.hazmat.primitives.serialization.load_der_pr
    ivate_key`, :func:`~cryptography.hazmat.primitives.serializat
    ion.load_pem_public_key`, :func:`~cryptography.hazmat.primiti
    ves.serialization.load_der_public_key`, and
    :meth:`~cryptography.x509.Certificate.public_key` when called
    on certificates with unsupported public key algorithms.
  * BACKWARDS INCOMPATIBLE: When parsing elliptic curve private
    keys, we now reject keys that incorrectly encode a private
    key of the wrong length because such keys are impossible to
    process in a constant-time manner. We do not believe keys
    with this problem are in wide use, however we may revert this
    change based on the feedback we receive.
  * Deprecated passing 64-bit (8-byte) and 128-bit (16-byte) keys
    to :class:`~cryptography.hazmat.decrepit.ciphers.algorithms.T
    ripleDES`. In a future release, only 192-bit (24-byte) keys
    will be accepted. Users should expand shorter keys themselves
    (e.g., for single DES: key + key + key, for two-key: key +
    key[:8]).
  * Updated the minimum supported Rust version (MSRV) to 1.83.0,
    from 1.74.0.
  * Support for x86_64 macOS (including publishing wheels) is
    deprecated and will be removed in the next release. We will
    switch to publishing an arm64 only wheel for macOS.
  * Support for 32-bit Windows (including publishing wheels) is
    deprecated and will be removed in the next release. Users
    should move to a 64-bit Python installation.
  * public_bytes and private_bytes methods on keys now raise
    TypeError (instead of ValueError) if an invalid encoding is
    provided for the given format.
  * Moved
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.CFB`,
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.OFB`, and
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.CFB8`
    into :doc:`/hazmat/decrepit/index` and deprecated them in the
    modes module. They will be removed from the modes module in
    49.0.0.
  * Moved :class:`~cryptography.hazmat.primitives.ciphers.algorit
    hms.Camellia` into  :doc:`/hazmat/decrepit/index` and
    deprecated it in the cipher module. It will be removed from
    the cipher module in 49.0.0.
  * Added
    :meth:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF.extract`
    to :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF`.
    The previous private implementation will be removed in
    49.0.0.
  * Added support for loading elliptic curve keys that contain
    explicit encodings of the curves secp256r1, secp384r1, and
    secp521r1.
  * Added support for
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2d`
    and
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2i`
    when using OpenSSL 3.2.0+.
  * Added derive_into methods to
    :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF`,
    :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDFExpand`,
    :class:`~cryptography.hazmat.primitives.kdf.concatkdf.ConcatK
    DFHash`, :class:`~cryptography.hazmat.primitives.kdf.concatkd
    f.ConcatKDFHMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2id`,
    :class:`~cryptography.hazmat.primitives.kdf.pbkdf2.PBKDF2HMAC
    `,
    :class:`~cryptography.hazmat.primitives.kdf.kbkdf.KBKDFHMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.kbkdf.KBKDFCMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.scrypt.Scrypt`,
    and
    :class:`~cryptography.hazmat.primitives.kdf.x963kdf.X963KDF`
    to allow deriving keys directly into pre-allocated buffers.
  * Added encrypt_into and decrypt_into methods to
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESCCM`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESGCM`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESGCMSI
    V`, :class:`~cryptography.hazmat.primitives.ciphers.aead.AESO
    CB3`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESSIV`,
    and :class:`~cryptography.hazmat.primitives.ciphers.aead.ChaC
    ha20Poly1305` to allow encrypting directly into a pre-
    allocated buffer.
  * Added support for PKCS1v15 signing without DigestInfo using :
    class:`~cryptography.hazmat.primitives.asymmetric.utils.NoDig
    estInfo`.
  * Added
    :meth:`~cryptography.hazmat.primitives.hashes.Hash.hash`, a
    one-shot method for computing hashes.
  * Added :doc:`/hazmat/primitives/hpke` support implementing RFC
    9180 for hybrid authenticated encryption.
  * Added new :doc:`/hazmat/primitives/asymmetric/mlkem` module
    with support for ML-KEM key encapsulation with AWS-LC and
    BoringSSL. Note: Post-quantum algorithm support requires AWS-
    LC or BoringSSL. As we ship our wheels with OpenSSL, most
    users will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Note: Post-quantum algorithm support requires AWS-LC or
    BoringSSL. As we ship our wheels with OpenSSL, most users
    will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Added new :doc:`/hazmat/primitives/asymmetric/mldsa` module
    with support for ML-DSA signing and verification with AWS-LC
    and BoringSSL. Note: Post-quantum algorithm support requires
    AWS-LC or BoringSSL. As we ship our wheels with OpenSSL, most
    users will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Note: Post-quantum algorithm support requires AWS-LC or
    BoringSSL. As we ship our wheels with OpenSSL, most users
    will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Added new :doc:`/hazmat/asn1/index` module with support for
    declaratively defining custom ASN.1 types and
    encoding/decoding them.
  * Fixed compilation when using LibreSSL 4.3.0 and OpenSSL
    4.0.0.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 4.0.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1778414400">- update to 48.0.0:
  * BACKWARDS INCOMPATIBLE: Support for Python 3.8 has been
    removed. cryptography now requires Python 3.9 or later.
  * BACKWARDS INCOMPATIBLE: Loading an X.509 CRL whose inner
    TBSCertList.signature algorithm does not match the outer
    signatureAlgorithm now raises ValueError. Previously, such
    CRLs were parsed successfully and only rejected during
    signature validation.
  * Added support for :doc:`/hazmat/primitives/asymmetric/mlkem`
    and :doc:`/hazmat/primitives/asymmetric/mldsa` when using
    OpenSSL 3.5.0 or later, in addition to the existing AWS-LC
    and BoringSSL support. This means post-quantum algorithms are
    now available to users of our wheels. Note: Going forward, we
    do not guarantee that all functionality in cryptography will
    be available when building against OpenSSL. See
    :doc:`/statements/state-of-openssl` for more information.
  * Note: Going forward, we do not guarantee that all
    functionality in cryptography will be available when building
    against OpenSSL. See :doc:`/statements/state-of-openssl` for
    more information.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1781438400">- update to 49.0.0:
  * BACKWARDS INCOMPATIBLE: Removed the deprecated
    PUBLIC_KEY_TYPES, PRIVATE_KEY_TYPES,
    CERTIFICATE_PRIVATE_KEY_TYPES,
    CERTIFICATE_ISSUER_PUBLIC_KEY_TYPES, and
    CERTIFICATE_PUBLIC_KEY_TYPES type aliases. Use
    PublicKeyTypes, PrivateKeyTypes,
    CertificateIssuerPrivateKeyTypes,
    CertificateIssuerPublicKeyTypes, and
    CertificatePublicKeyTypes instead. These were deprecated in
    version 40.0.
  * BACKWARDS INCOMPATIBLE: :class:`~cryptography.hazmat.primitiv
    es.ciphers.algorithms.ChaCha20` now treats the first 4 bytes
    of the nonce as a 32-bit little-endian block counter (as
    defined in RFC 7539) and tracks the number of bytes
    processed. Attempting to encrypt or decrypt more data than
    the counter allows before it would overflow now raises a
    :class:`ValueError` rather than silently diverging from RFC
    7539. Setting the counter portion of the nonce to zero allows
    encrypting up to 256 GiB with a given nonce.
  * BACKWARDS INCOMPATIBLE: Loading an X.509 certificate whose
    ECDSA or DSA signature AlgorithmIdentifier contains encoded
    NULL parameters now raises a :class:`ValueError`. Such
    certificates are invalid, but older versions of Java emitted
    them; previously they loaded with a deprecation warning.
  * Fixed cross-compilation of the CFFI bindings when
    PYO3_CROSS_LIB_DIR is set. The build now derives the Python
    include directory from PYO3_CROSS_LIB_DIR instead of querying
    the host interpreter, which previously caused the build to
    fail during cross-compilations for embedded systems, on hosts
    which have same-version Python development headers installed
    as the target Python.
  * Added support for signing and verifying X.509 certificates,
    certificate signing requests, and certificate revocation
    lists with :doc:`/hazmat/primitives/asymmetric/mldsa` keys,
    as well as loading certificates that contain ML-DSA public
    keys.
  * Added
    :meth:`~cryptography.hazmat.primitives.hpke.KEM.enc_length`
    to :class:`~cryptography.hazmat.primitives.hpke.KEM` so
    callers can split the encapsulated key from the ciphertext
    returned by
    :meth:`~cryptography.hazmat.primitives.hpke.Suite.encrypt`.
  * :meth:`~cryptography.x509.verification.ExtensionPolicy.requir
    e_present`, :meth:`~cryptography.x509.verification.ExtensionP
    olicy.may_be_present`, and :meth:`~cryptography.x509.verifica
    tion.ExtensionPolicy.require_not_present` now accept any
    extension type. Previously only a fixed set of extension
    types was supported, which made it impossible to account for
    otherwise unrecognized critical extensions during path
    validation.
  * Added support for using
    :class:`~cryptography.x509.Certificate`,
    :class:`~cryptography.x509.CertificateSigningRequest`, and
    :class:`~cryptography.x509.CertificateRevocationList` as
    field types in :doc:`/hazmat/asn1/index` structures.
  * Added :func:`~cryptography.hazmat.asn1.value_set`, a class
    decorator that registers an :class:`enum.Enum` subclass as an
    ASN.1 value set: members are encoded as their underlying
    value, and decoding fails if the decoded value does not match
    one of the declared members.
  * Added :meth:`~cryptography.x509.Name.from_bytes` for parsing
    a :class:`~cryptography.x509.Name` from DER bytes, the
    inverse of :meth:`~cryptography.x509.Name.public_bytes`.
  * Added the rsa_padding keyword-only parameter to
    :meth:`~cryptography.x509.CertificateBuilder.public_key`.
    Passing the :class:`~cryptography.hazmat.primitives.asymmetri
    c.padding.PSS` class (not an instance) encodes an RSA subject
    public key in the certificate's subjectPublicKeyInfo with the
    id-RSASSA-PSS OID and no parameters.
  * Added external mu (message representative) support to
    :doc:`/hazmat/primitives/asymmetric/mldsa` via the sign_mu
    and verify_mu methods, which sign and verify a precomputed
    64-byte mu as defined in FIPS 204.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 4.0.1.</changelog>
</package>
<package pkgid="fc50bb66c28c03570871ac24a4fe1fe6ffd6b2ecf1a8306ddb71539e284c8c3728ffab5101d1e1633364d8b67960aa2a7626fa8d8069ec8c9d77190869c80ba3" name="python314-cryptography" arch="armv7hl">
  <version epoch="0" ver="49.0.0" rel="289.3"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1727524800">- update to 43.0.1:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.3.2.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1729598400">- update to 43.0.3:
  * Fixed release metadata for cryptography-vectors
  * Fixed compilation when using LibreSSL 4.0.0.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1730808000">- Avoid using requires_eq, which after the last modifications
  conflicts with python singlespec (order of expansion).</changelog>
  <changelog author="Ben Greiner &lt;code@bnavigator.de&gt;" date="1731067200">- Fix requires_eq replacement for distributions which do not have
  python3-cffi installed (such as SLE15 python module pythons)
  * gh#openSUSE/python-rpm-macros#185
- Remove outdated section in description</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfyhalomacro@opensuse.org&gt;" date="1737892800">- Update to version 44.0.0:
  * BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL &lt; 3.9.
  * Deprecated Python 3.7 support. Python 3.7 is no longer supported by
    the Python core team. Support for Python 3.7 will be removed in a future
    cryptography release.
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.4.0.
  * macOS wheels are now built against the macOS 10.13 SDK. Users on older
    versions of macOS should upgrade, or they will need to build cryptography
    themselves.
  * Enforce the RFC 5280 requirement that extended key usage extensions must not be empty.
  * Added support for timestamp extraction to the :class:`~cryptography.fernet.MultiFernet` class.
  * Relax the Authority Key Identifier requirements on root CA certificates
    during X.509 verification to allow fields permitted by RFC 5280 but
    forbidden by the CA/Browser BRs.
  * Added support for
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2id` when using
    OpenSSL 3.2.0+.
  * Added support for the :class:`~cryptography.x509.Admissions` certificate extension.
  * Added basic support for PKCS7 decryption (including S/MIME 3.2) via
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der`,
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_pem`,
    and :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_smime`.
- Update specfile to accommodate new project structure at version 44.0.0
- Update no-pytest_benchmark.patch</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1740571200">- update to 44.0.1:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.4.1.
  * We now build armv7l manylinux wheels and publish them to
    PyPI.
  * We now build manylinux_2_34 wheels and publish them to PyPI.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1742731200">- update to 44.0.2:
  * We now build wheels for PyPy 3.11.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1746619200">- Update to 44.0.3
  * Fixed compilation when using LibreSSL 4.1.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1752321600">- update to 45.0.5:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.1.
  * Fixed decrypting PKCS#8 files encrypted with SHA1-RC4. (This
    is not considered secure, and is supported only for backwards
    compatibility.)
  * Fixed decrypting PKCS#8 files encrypted with long salts (this
    impacts keys encrypted by Bouncy Castle).
  * Fixed decrypting PKCS#8 files encrypted with DES-CBC-MD5.
    While wildly insecure, this remains prevalent.
  * Fixed using mypy with cryptography on older versions of
    Python.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.0.
  * Support for Python 3.7 is deprecated and will be removed in
    the next cryptography release.
  * Updated the minimum supported Rust version (MSRV) to 1.74.0,
    from 1.65.0.
  * Added support for serialization of PKCS#12 Java truststores
    in :func:`~cryptography.hazmat.primitives.serialization.pkcs1
    2.serialize_java_truststore`
  * Added :meth:`~cryptography.hazmat.primitives.kdf.argon2.Argon
    2id.derive_phc_encoded` and :meth:`~cryptography.hazmat.primi
    tives.kdf.argon2.Argon2id.verify_phc_encoded` methods to
    support password hashing in the PHC string format
  * Added support for PKCS7 decryption and encryption using
    AES-256 as the content algorithm, in addition to AES-128.
  * BACKWARDS INCOMPATIBLE: Made SSH private key loading more
    consistent with other private key loading: :func:`~cryptograp
    hy.hazmat.primitives.serialization.load_ssh_private_key` now
    raises a TypeError if the key is unencrypted but a password
    is provided (previously no exception was raised), and raises
    a TypeError if the key is encrypted but no password is
    provided (previously a ValueError was raised).
  * Added __copy__ to the :class:`~cryptography.hazmat.primitives
    .asymmetric.ec.EllipticCurvePrivateKey`, :class:`~cryptograph
    y.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey`, :c
    lass:`~cryptography.hazmat.primitives.asymmetric.ed25519.Ed25
    519PublicKey`, :class:`~cryptography.hazmat.primitives.asymme
    tric.ed25519.Ed25519PrivateKey`, :class:`~cryptography.hazmat
    .primitives.asymmetric.ed448.Ed448PublicKey`, :class:`~crypto
    graphy.hazmat.primitives.asymmetric.ed448.Ed448PrivateKey`, :
    class:`~cryptography.hazmat.primitives.asymmetric.x25519.X255
    19PublicKey`, :class:`~cryptography.hazmat.primitives.asymmet
    ric.x25519.X25519PrivateKey`, :class:`~cryptography.hazmat.pr
    imitives.asymmetric.x448.X448PublicKey`, :class:`~cryptograph
    y.hazmat.primitives.asymmetric.x448.X448PrivateKey`, :class:`
    ~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey`
    , :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAP
    ublicKey`, :class:`~cryptography.hazmat.primitives.asymmetric
    .dsa.DSAPrivateKey`, :class:`~cryptography.hazmat.primitives.
    asymmetric.dsa.DSAPublicKey`, :class:`~cryptography.hazmat.pr
    imitives.asymmetric.dh.DHPrivateKey`, and :class:`~cryptograp
    hy.hazmat.primitives.asymmetric.dh.DHPublicKey` abstract base
    classes.
  * We significantly refactored how private key loading ( :func:`
    ~cryptography.hazmat.primitives.serialization.load_pem_privat
    e_key` and :func:`~cryptography.hazmat.primitives.serializati
    on.load_der_private_key`) works. This is intended to be
    backwards compatible for all well-formed keys, therefore if
    you discover a key that now raises an exception, please file
    a bug with instructions for reproducing.
  * Added unsafe_skip_rsa_key_validation keyword-argument to :fun
    c:`~cryptography.hazmat.primitives.serialization.load_ssh_pri
    vate_key`.
  * Added :class:`~cryptography.hazmat.primitives.hashes.XOFHash`
    to support repeated :meth:`~cryptography.hazmat.primitives.ha
    shes.XOFHash.squeeze` operations on extendable output
    functions.
  * Added :meth:`~cryptography.x509.ocsp.OCSPResponseBuilder.add_
    response_by_hash` method to allow creating OCSP responses
    using certificate hash values rather than full certificates.
  * Extended the :mod:`X.509 path validation
    &lt;cryptography.x509.verification&gt;` API to support user-
    configured extension policies via the
    :meth:`PolicyBuilder.extension_policies &lt;cryptography.x509.ve
    rification.PolicyBuilder.extension_policies&gt;` method.
  * Deprecated the subject, verification_time and max_chain_depth
    properties on
    :class:`~cryptography.x509.verification.ClientVerifier` and
    :class:`~cryptography.x509.verification.ServerVerifier` in
    favor of a new policy property. These properties will be
    removed in the next release of cryptography.
  * BACKWARDS INCOMPATIBLE: The :meth:`VerifiedClient.subject
    &lt;cryptography.x509.verification.VerifiedClient.subjects&gt;`
    property can now be None since a custom extension policy may
    allow certificates without a Subject Alternative Name
    extension.
  * Changed the behavior when the OpenSSL 3 legacy provider fails
    to load. Instead of raising an exception, a warning is now
    emitted. The CRYPTOGRAPHY_OPENSSL_NO_LEGACY environment
    variable can still be used to disable the legacy provider at
    runtime.
  * Added support for the CRYPTOGRAPHY_BUILD_OPENSSL_NO_LEGACY
    environment variable during build time, which prevents the
    library from ever attempting to load the legacy provider.
  * Added support for the
    :class:`~cryptography.x509.PrivateKeyUsagePeriod` X.509
    extension. This extension defines the period during which the
    private key corresponding to the certificate's public key may
    be used.
  * Added support for compiling against `aws-lc`_.
  * Parsing X.509 structures now more strictly enforces that Name
    structures do not have malformed ASN.1.
  * We now publish py311 wheels that utilize the faster
    pyo3::buffer::PyBuffer interface, resulting in significantly
    improved performance for operations involving small buffers.
  * Added :func:`~cryptography.hazmat.primitives.serialization.ss
    h_key_fingerprint` for computing fingerprints of SSH public
    keys.
  * Added support for deterministic ECDSA signing via the new
    keyword-only argument ecdsa_deterministic in
    :meth:`~cryptography.x509.CertificateBuilder.sign`, :meth:`~c
    ryptography.x509.CertificateRevocationListBuilder.sign` and :
    meth:`~cryptography.x509.CertificateSigningRequestBuilder.sig
    n`.</changelog>
  <changelog author="James Oakley &lt;jfunk@opensuse.org&gt;" date="1756728000">- Add Make-unsafe-subinterpreter-support-available-via-cfg.patch
  to allow ceph-mgr to load modules (boo#1248987)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1757851200">- update to 45.0.7:
  * Added a function to support an upcoming pyOpenSSL release.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1760356800">- update to 46.0.2:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.4.
  * Fixed an issue where users installing via pip on Python 3.14
    development versions would not properly install a dependency.
  * Fixed an issue building the free-threaded macOS 3.14 wheels.
  * BACKWARDS INCOMPATIBLE: Support for Python 3.7 has been
    removed.
  * Support for OpenSSL &lt; 3.0 is deprecated and will be removed
    in the next release.
  * Support for x86_64 macOS (including publishing wheels) is
    deprecated and will be removed in two releases. We will
    switch to publishing an arm64 only wheel for macOS.
  * Support for 32-bit Windows (including publishing wheels) is
    deprecated and will be removed in two releases. Users should
    move to a 64-bit Python installation.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.3.
  * We now build ppc64le manylinux wheels and publish them to
    PyPI.
  * We now build win_arm64 (Windows on Arm) wheels and publish
    them to PyPI.
  * Added support for free-threaded Python 3.14.
  * Removed the deprecated get_attribute_for_oid method on
    :class:`~cryptography.x509.CertificateSigningRequest`. Users
    should use
    :meth:`~cryptography.x509.Attributes.get_attribute_for_oid`
    instead.
  * Removed the deprecated CAST5, SEED, IDEA, and Blowfish
    classes from the cipher module. These are still available in
    :doc:`/hazmat/decrepit/index`.
  * In X.509, when performing a PSS signature with a SHA-3 hash,
    it is now encoded with the official NIST SHA3 OID.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1765195200">- Only require pytest-subtests with pytest &lt; 9.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1770897600">- Update to 46.0.5 (fixes CVE-2026-26007, bsc#1258074)
  * An attacker could create a malicious public key that reveals portions of
    your private key when using certain uncommon elliptic curves (binary
    curves). This version now includes additional security checks to prevent
    this attack. This issue only affects binary elliptic curves, which are
    rarely used in real-world applications. Credit to XlabAI Team of Tencent
    Xuanwu Lab and Atuin Automated Vulnerability Discovery Engine for reporting
    the issue. CVE-2026-26007
  * Support for SECT* binary elliptic curves is deprecated and will be removed
    in the next release.
- Update to 46.0.4
  * Dropped support for win_arm64 wheels.
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.5.
- Update to 46.0.3
  * Fixed compilation when using LibreSSL 4.2.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1774612800">- update to 46.0.6 (CVE-2026-34073, bsc#1260876):
  * SECURITY ISSUE: Fixed a bug where name constraints were not
    applied to peer names during verification when the leaf
    certificate contains a wildcard DNS SAN. Ordinary X.509
    topologies are not affected by this bug, including those used
    by the Web PKI. Credit to Oleh Konko (1seal) for reporting
    the issue. CVE-2026-34073</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1774958400">- Add patch support-maturin-1.12.patch:
  * Correctly deal with maturin bugfix that installs tests and
    docs under sitearch.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1775822400">- Update to 46.0.7 (fixes CVE-2026-39892, bsc#1261863)
  * **SECURITY ISSUE**: Fixed an issue where non-contiguous buffers could be
    passed to APIs that accept Python buffers, which could lead to buffer
    overflow. **CVE-2026-39892**
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.6.
- drop support-maturin-1.12.patch (upstream)
- drop no-pytest_benchmark.patch,
  Make-unsafe-subinterpreter-support-available-via-cfg.patch:
  obsolete</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1777204800">- update to 47.0.0:
  * Support for Python 3.8 is deprecated and will be removed in
    the next cryptography release.
  * BACKWARDS INCOMPATIBLE: Support for binary elliptic curves
    (SECT* classes) has been removed. These curves are rarely
    used and have additional security considerations that make
    them undesirable.
  * BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.1.x has been
    removed. OpenSSL 3.0.0 or later is now required. LibreSSL,
    BoringSSL, and AWS-LC continue to be supported.
  * BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL &lt; 4.1.
  * BACKWARDS INCOMPATIBLE: Loading keys with unsupported
    algorithms or keys with unsupported explicit curve encodings
    now raises
    :class:`~cryptography.exceptions.UnsupportedAlgorithm`
    instead of ValueError. This change affects :func:`~cryptograp
    hy.hazmat.primitives.serialization.load_pem_private_key`, :fu
    nc:`~cryptography.hazmat.primitives.serialization.load_der_pr
    ivate_key`, :func:`~cryptography.hazmat.primitives.serializat
    ion.load_pem_public_key`, :func:`~cryptography.hazmat.primiti
    ves.serialization.load_der_public_key`, and
    :meth:`~cryptography.x509.Certificate.public_key` when called
    on certificates with unsupported public key algorithms.
  * BACKWARDS INCOMPATIBLE: When parsing elliptic curve private
    keys, we now reject keys that incorrectly encode a private
    key of the wrong length because such keys are impossible to
    process in a constant-time manner. We do not believe keys
    with this problem are in wide use, however we may revert this
    change based on the feedback we receive.
  * Deprecated passing 64-bit (8-byte) and 128-bit (16-byte) keys
    to :class:`~cryptography.hazmat.decrepit.ciphers.algorithms.T
    ripleDES`. In a future release, only 192-bit (24-byte) keys
    will be accepted. Users should expand shorter keys themselves
    (e.g., for single DES: key + key + key, for two-key: key +
    key[:8]).
  * Updated the minimum supported Rust version (MSRV) to 1.83.0,
    from 1.74.0.
  * Support for x86_64 macOS (including publishing wheels) is
    deprecated and will be removed in the next release. We will
    switch to publishing an arm64 only wheel for macOS.
  * Support for 32-bit Windows (including publishing wheels) is
    deprecated and will be removed in the next release. Users
    should move to a 64-bit Python installation.
  * public_bytes and private_bytes methods on keys now raise
    TypeError (instead of ValueError) if an invalid encoding is
    provided for the given format.
  * Moved
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.CFB`,
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.OFB`, and
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.CFB8`
    into :doc:`/hazmat/decrepit/index` and deprecated them in the
    modes module. They will be removed from the modes module in
    49.0.0.
  * Moved :class:`~cryptography.hazmat.primitives.ciphers.algorit
    hms.Camellia` into  :doc:`/hazmat/decrepit/index` and
    deprecated it in the cipher module. It will be removed from
    the cipher module in 49.0.0.
  * Added
    :meth:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF.extract`
    to :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF`.
    The previous private implementation will be removed in
    49.0.0.
  * Added support for loading elliptic curve keys that contain
    explicit encodings of the curves secp256r1, secp384r1, and
    secp521r1.
  * Added support for
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2d`
    and
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2i`
    when using OpenSSL 3.2.0+.
  * Added derive_into methods to
    :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF`,
    :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDFExpand`,
    :class:`~cryptography.hazmat.primitives.kdf.concatkdf.ConcatK
    DFHash`, :class:`~cryptography.hazmat.primitives.kdf.concatkd
    f.ConcatKDFHMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2id`,
    :class:`~cryptography.hazmat.primitives.kdf.pbkdf2.PBKDF2HMAC
    `,
    :class:`~cryptography.hazmat.primitives.kdf.kbkdf.KBKDFHMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.kbkdf.KBKDFCMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.scrypt.Scrypt`,
    and
    :class:`~cryptography.hazmat.primitives.kdf.x963kdf.X963KDF`
    to allow deriving keys directly into pre-allocated buffers.
  * Added encrypt_into and decrypt_into methods to
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESCCM`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESGCM`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESGCMSI
    V`, :class:`~cryptography.hazmat.primitives.ciphers.aead.AESO
    CB3`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESSIV`,
    and :class:`~cryptography.hazmat.primitives.ciphers.aead.ChaC
    ha20Poly1305` to allow encrypting directly into a pre-
    allocated buffer.
  * Added support for PKCS1v15 signing without DigestInfo using :
    class:`~cryptography.hazmat.primitives.asymmetric.utils.NoDig
    estInfo`.
  * Added
    :meth:`~cryptography.hazmat.primitives.hashes.Hash.hash`, a
    one-shot method for computing hashes.
  * Added :doc:`/hazmat/primitives/hpke` support implementing RFC
    9180 for hybrid authenticated encryption.
  * Added new :doc:`/hazmat/primitives/asymmetric/mlkem` module
    with support for ML-KEM key encapsulation with AWS-LC and
    BoringSSL. Note: Post-quantum algorithm support requires AWS-
    LC or BoringSSL. As we ship our wheels with OpenSSL, most
    users will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Note: Post-quantum algorithm support requires AWS-LC or
    BoringSSL. As we ship our wheels with OpenSSL, most users
    will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Added new :doc:`/hazmat/primitives/asymmetric/mldsa` module
    with support for ML-DSA signing and verification with AWS-LC
    and BoringSSL. Note: Post-quantum algorithm support requires
    AWS-LC or BoringSSL. As we ship our wheels with OpenSSL, most
    users will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Note: Post-quantum algorithm support requires AWS-LC or
    BoringSSL. As we ship our wheels with OpenSSL, most users
    will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Added new :doc:`/hazmat/asn1/index` module with support for
    declaratively defining custom ASN.1 types and
    encoding/decoding them.
  * Fixed compilation when using LibreSSL 4.3.0 and OpenSSL
    4.0.0.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 4.0.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1778414400">- update to 48.0.0:
  * BACKWARDS INCOMPATIBLE: Support for Python 3.8 has been
    removed. cryptography now requires Python 3.9 or later.
  * BACKWARDS INCOMPATIBLE: Loading an X.509 CRL whose inner
    TBSCertList.signature algorithm does not match the outer
    signatureAlgorithm now raises ValueError. Previously, such
    CRLs were parsed successfully and only rejected during
    signature validation.
  * Added support for :doc:`/hazmat/primitives/asymmetric/mlkem`
    and :doc:`/hazmat/primitives/asymmetric/mldsa` when using
    OpenSSL 3.5.0 or later, in addition to the existing AWS-LC
    and BoringSSL support. This means post-quantum algorithms are
    now available to users of our wheels. Note: Going forward, we
    do not guarantee that all functionality in cryptography will
    be available when building against OpenSSL. See
    :doc:`/statements/state-of-openssl` for more information.
  * Note: Going forward, we do not guarantee that all
    functionality in cryptography will be available when building
    against OpenSSL. See :doc:`/statements/state-of-openssl` for
    more information.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1781438400">- update to 49.0.0:
  * BACKWARDS INCOMPATIBLE: Removed the deprecated
    PUBLIC_KEY_TYPES, PRIVATE_KEY_TYPES,
    CERTIFICATE_PRIVATE_KEY_TYPES,
    CERTIFICATE_ISSUER_PUBLIC_KEY_TYPES, and
    CERTIFICATE_PUBLIC_KEY_TYPES type aliases. Use
    PublicKeyTypes, PrivateKeyTypes,
    CertificateIssuerPrivateKeyTypes,
    CertificateIssuerPublicKeyTypes, and
    CertificatePublicKeyTypes instead. These were deprecated in
    version 40.0.
  * BACKWARDS INCOMPATIBLE: :class:`~cryptography.hazmat.primitiv
    es.ciphers.algorithms.ChaCha20` now treats the first 4 bytes
    of the nonce as a 32-bit little-endian block counter (as
    defined in RFC 7539) and tracks the number of bytes
    processed. Attempting to encrypt or decrypt more data than
    the counter allows before it would overflow now raises a
    :class:`ValueError` rather than silently diverging from RFC
    7539. Setting the counter portion of the nonce to zero allows
    encrypting up to 256 GiB with a given nonce.
  * BACKWARDS INCOMPATIBLE: Loading an X.509 certificate whose
    ECDSA or DSA signature AlgorithmIdentifier contains encoded
    NULL parameters now raises a :class:`ValueError`. Such
    certificates are invalid, but older versions of Java emitted
    them; previously they loaded with a deprecation warning.
  * Fixed cross-compilation of the CFFI bindings when
    PYO3_CROSS_LIB_DIR is set. The build now derives the Python
    include directory from PYO3_CROSS_LIB_DIR instead of querying
    the host interpreter, which previously caused the build to
    fail during cross-compilations for embedded systems, on hosts
    which have same-version Python development headers installed
    as the target Python.
  * Added support for signing and verifying X.509 certificates,
    certificate signing requests, and certificate revocation
    lists with :doc:`/hazmat/primitives/asymmetric/mldsa` keys,
    as well as loading certificates that contain ML-DSA public
    keys.
  * Added
    :meth:`~cryptography.hazmat.primitives.hpke.KEM.enc_length`
    to :class:`~cryptography.hazmat.primitives.hpke.KEM` so
    callers can split the encapsulated key from the ciphertext
    returned by
    :meth:`~cryptography.hazmat.primitives.hpke.Suite.encrypt`.
  * :meth:`~cryptography.x509.verification.ExtensionPolicy.requir
    e_present`, :meth:`~cryptography.x509.verification.ExtensionP
    olicy.may_be_present`, and :meth:`~cryptography.x509.verifica
    tion.ExtensionPolicy.require_not_present` now accept any
    extension type. Previously only a fixed set of extension
    types was supported, which made it impossible to account for
    otherwise unrecognized critical extensions during path
    validation.
  * Added support for using
    :class:`~cryptography.x509.Certificate`,
    :class:`~cryptography.x509.CertificateSigningRequest`, and
    :class:`~cryptography.x509.CertificateRevocationList` as
    field types in :doc:`/hazmat/asn1/index` structures.
  * Added :func:`~cryptography.hazmat.asn1.value_set`, a class
    decorator that registers an :class:`enum.Enum` subclass as an
    ASN.1 value set: members are encoded as their underlying
    value, and decoding fails if the decoded value does not match
    one of the declared members.
  * Added :meth:`~cryptography.x509.Name.from_bytes` for parsing
    a :class:`~cryptography.x509.Name` from DER bytes, the
    inverse of :meth:`~cryptography.x509.Name.public_bytes`.
  * Added the rsa_padding keyword-only parameter to
    :meth:`~cryptography.x509.CertificateBuilder.public_key`.
    Passing the :class:`~cryptography.hazmat.primitives.asymmetri
    c.padding.PSS` class (not an instance) encodes an RSA subject
    public key in the certificate's subjectPublicKeyInfo with the
    id-RSASSA-PSS OID and no parameters.
  * Added external mu (message representative) support to
    :doc:`/hazmat/primitives/asymmetric/mldsa` via the sign_mu
    and verify_mu methods, which sign and verify a precomputed
    64-byte mu as defined in FIPS 204.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 4.0.1.</changelog>
</package>
<package pkgid="8ece29f37f5c1beca51048c2605a9e3be461ba35b77b0baba570b1001dfa26a69d5cf0078463012a592ca19150621e2cec9fd6be790ae008e68803b140c80935" name="python314-cryptography" arch="x86_64">
  <version epoch="0" ver="49.0.0" rel="289.3"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1727524800">- update to 43.0.1:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.3.2.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1729598400">- update to 43.0.3:
  * Fixed release metadata for cryptography-vectors
  * Fixed compilation when using LibreSSL 4.0.0.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1730808000">- Avoid using requires_eq, which after the last modifications
  conflicts with python singlespec (order of expansion).</changelog>
  <changelog author="Ben Greiner &lt;code@bnavigator.de&gt;" date="1731067200">- Fix requires_eq replacement for distributions which do not have
  python3-cffi installed (such as SLE15 python module pythons)
  * gh#openSUSE/python-rpm-macros#185
- Remove outdated section in description</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfyhalomacro@opensuse.org&gt;" date="1737892800">- Update to version 44.0.0:
  * BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL &lt; 3.9.
  * Deprecated Python 3.7 support. Python 3.7 is no longer supported by
    the Python core team. Support for Python 3.7 will be removed in a future
    cryptography release.
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.4.0.
  * macOS wheels are now built against the macOS 10.13 SDK. Users on older
    versions of macOS should upgrade, or they will need to build cryptography
    themselves.
  * Enforce the RFC 5280 requirement that extended key usage extensions must not be empty.
  * Added support for timestamp extraction to the :class:`~cryptography.fernet.MultiFernet` class.
  * Relax the Authority Key Identifier requirements on root CA certificates
    during X.509 verification to allow fields permitted by RFC 5280 but
    forbidden by the CA/Browser BRs.
  * Added support for
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2id` when using
    OpenSSL 3.2.0+.
  * Added support for the :class:`~cryptography.x509.Admissions` certificate extension.
  * Added basic support for PKCS7 decryption (including S/MIME 3.2) via
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der`,
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_pem`,
    and :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_smime`.
- Update specfile to accommodate new project structure at version 44.0.0
- Update no-pytest_benchmark.patch</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1740571200">- update to 44.0.1:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.4.1.
  * We now build armv7l manylinux wheels and publish them to
    PyPI.
  * We now build manylinux_2_34 wheels and publish them to PyPI.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1742731200">- update to 44.0.2:
  * We now build wheels for PyPy 3.11.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1746619200">- Update to 44.0.3
  * Fixed compilation when using LibreSSL 4.1.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1752321600">- update to 45.0.5:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.1.
  * Fixed decrypting PKCS#8 files encrypted with SHA1-RC4. (This
    is not considered secure, and is supported only for backwards
    compatibility.)
  * Fixed decrypting PKCS#8 files encrypted with long salts (this
    impacts keys encrypted by Bouncy Castle).
  * Fixed decrypting PKCS#8 files encrypted with DES-CBC-MD5.
    While wildly insecure, this remains prevalent.
  * Fixed using mypy with cryptography on older versions of
    Python.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.0.
  * Support for Python 3.7 is deprecated and will be removed in
    the next cryptography release.
  * Updated the minimum supported Rust version (MSRV) to 1.74.0,
    from 1.65.0.
  * Added support for serialization of PKCS#12 Java truststores
    in :func:`~cryptography.hazmat.primitives.serialization.pkcs1
    2.serialize_java_truststore`
  * Added :meth:`~cryptography.hazmat.primitives.kdf.argon2.Argon
    2id.derive_phc_encoded` and :meth:`~cryptography.hazmat.primi
    tives.kdf.argon2.Argon2id.verify_phc_encoded` methods to
    support password hashing in the PHC string format
  * Added support for PKCS7 decryption and encryption using
    AES-256 as the content algorithm, in addition to AES-128.
  * BACKWARDS INCOMPATIBLE: Made SSH private key loading more
    consistent with other private key loading: :func:`~cryptograp
    hy.hazmat.primitives.serialization.load_ssh_private_key` now
    raises a TypeError if the key is unencrypted but a password
    is provided (previously no exception was raised), and raises
    a TypeError if the key is encrypted but no password is
    provided (previously a ValueError was raised).
  * Added __copy__ to the :class:`~cryptography.hazmat.primitives
    .asymmetric.ec.EllipticCurvePrivateKey`, :class:`~cryptograph
    y.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey`, :c
    lass:`~cryptography.hazmat.primitives.asymmetric.ed25519.Ed25
    519PublicKey`, :class:`~cryptography.hazmat.primitives.asymme
    tric.ed25519.Ed25519PrivateKey`, :class:`~cryptography.hazmat
    .primitives.asymmetric.ed448.Ed448PublicKey`, :class:`~crypto
    graphy.hazmat.primitives.asymmetric.ed448.Ed448PrivateKey`, :
    class:`~cryptography.hazmat.primitives.asymmetric.x25519.X255
    19PublicKey`, :class:`~cryptography.hazmat.primitives.asymmet
    ric.x25519.X25519PrivateKey`, :class:`~cryptography.hazmat.pr
    imitives.asymmetric.x448.X448PublicKey`, :class:`~cryptograph
    y.hazmat.primitives.asymmetric.x448.X448PrivateKey`, :class:`
    ~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey`
    , :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAP
    ublicKey`, :class:`~cryptography.hazmat.primitives.asymmetric
    .dsa.DSAPrivateKey`, :class:`~cryptography.hazmat.primitives.
    asymmetric.dsa.DSAPublicKey`, :class:`~cryptography.hazmat.pr
    imitives.asymmetric.dh.DHPrivateKey`, and :class:`~cryptograp
    hy.hazmat.primitives.asymmetric.dh.DHPublicKey` abstract base
    classes.
  * We significantly refactored how private key loading ( :func:`
    ~cryptography.hazmat.primitives.serialization.load_pem_privat
    e_key` and :func:`~cryptography.hazmat.primitives.serializati
    on.load_der_private_key`) works. This is intended to be
    backwards compatible for all well-formed keys, therefore if
    you discover a key that now raises an exception, please file
    a bug with instructions for reproducing.
  * Added unsafe_skip_rsa_key_validation keyword-argument to :fun
    c:`~cryptography.hazmat.primitives.serialization.load_ssh_pri
    vate_key`.
  * Added :class:`~cryptography.hazmat.primitives.hashes.XOFHash`
    to support repeated :meth:`~cryptography.hazmat.primitives.ha
    shes.XOFHash.squeeze` operations on extendable output
    functions.
  * Added :meth:`~cryptography.x509.ocsp.OCSPResponseBuilder.add_
    response_by_hash` method to allow creating OCSP responses
    using certificate hash values rather than full certificates.
  * Extended the :mod:`X.509 path validation
    &lt;cryptography.x509.verification&gt;` API to support user-
    configured extension policies via the
    :meth:`PolicyBuilder.extension_policies &lt;cryptography.x509.ve
    rification.PolicyBuilder.extension_policies&gt;` method.
  * Deprecated the subject, verification_time and max_chain_depth
    properties on
    :class:`~cryptography.x509.verification.ClientVerifier` and
    :class:`~cryptography.x509.verification.ServerVerifier` in
    favor of a new policy property. These properties will be
    removed in the next release of cryptography.
  * BACKWARDS INCOMPATIBLE: The :meth:`VerifiedClient.subject
    &lt;cryptography.x509.verification.VerifiedClient.subjects&gt;`
    property can now be None since a custom extension policy may
    allow certificates without a Subject Alternative Name
    extension.
  * Changed the behavior when the OpenSSL 3 legacy provider fails
    to load. Instead of raising an exception, a warning is now
    emitted. The CRYPTOGRAPHY_OPENSSL_NO_LEGACY environment
    variable can still be used to disable the legacy provider at
    runtime.
  * Added support for the CRYPTOGRAPHY_BUILD_OPENSSL_NO_LEGACY
    environment variable during build time, which prevents the
    library from ever attempting to load the legacy provider.
  * Added support for the
    :class:`~cryptography.x509.PrivateKeyUsagePeriod` X.509
    extension. This extension defines the period during which the
    private key corresponding to the certificate's public key may
    be used.
  * Added support for compiling against `aws-lc`_.
  * Parsing X.509 structures now more strictly enforces that Name
    structures do not have malformed ASN.1.
  * We now publish py311 wheels that utilize the faster
    pyo3::buffer::PyBuffer interface, resulting in significantly
    improved performance for operations involving small buffers.
  * Added :func:`~cryptography.hazmat.primitives.serialization.ss
    h_key_fingerprint` for computing fingerprints of SSH public
    keys.
  * Added support for deterministic ECDSA signing via the new
    keyword-only argument ecdsa_deterministic in
    :meth:`~cryptography.x509.CertificateBuilder.sign`, :meth:`~c
    ryptography.x509.CertificateRevocationListBuilder.sign` and :
    meth:`~cryptography.x509.CertificateSigningRequestBuilder.sig
    n`.</changelog>
  <changelog author="James Oakley &lt;jfunk@opensuse.org&gt;" date="1756728000">- Add Make-unsafe-subinterpreter-support-available-via-cfg.patch
  to allow ceph-mgr to load modules (boo#1248987)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1757851200">- update to 45.0.7:
  * Added a function to support an upcoming pyOpenSSL release.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1760356800">- update to 46.0.2:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.4.
  * Fixed an issue where users installing via pip on Python 3.14
    development versions would not properly install a dependency.
  * Fixed an issue building the free-threaded macOS 3.14 wheels.
  * BACKWARDS INCOMPATIBLE: Support for Python 3.7 has been
    removed.
  * Support for OpenSSL &lt; 3.0 is deprecated and will be removed
    in the next release.
  * Support for x86_64 macOS (including publishing wheels) is
    deprecated and will be removed in two releases. We will
    switch to publishing an arm64 only wheel for macOS.
  * Support for 32-bit Windows (including publishing wheels) is
    deprecated and will be removed in two releases. Users should
    move to a 64-bit Python installation.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.3.
  * We now build ppc64le manylinux wheels and publish them to
    PyPI.
  * We now build win_arm64 (Windows on Arm) wheels and publish
    them to PyPI.
  * Added support for free-threaded Python 3.14.
  * Removed the deprecated get_attribute_for_oid method on
    :class:`~cryptography.x509.CertificateSigningRequest`. Users
    should use
    :meth:`~cryptography.x509.Attributes.get_attribute_for_oid`
    instead.
  * Removed the deprecated CAST5, SEED, IDEA, and Blowfish
    classes from the cipher module. These are still available in
    :doc:`/hazmat/decrepit/index`.
  * In X.509, when performing a PSS signature with a SHA-3 hash,
    it is now encoded with the official NIST SHA3 OID.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1765195200">- Only require pytest-subtests with pytest &lt; 9.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1770897600">- Update to 46.0.5 (fixes CVE-2026-26007, bsc#1258074)
  * An attacker could create a malicious public key that reveals portions of
    your private key when using certain uncommon elliptic curves (binary
    curves). This version now includes additional security checks to prevent
    this attack. This issue only affects binary elliptic curves, which are
    rarely used in real-world applications. Credit to XlabAI Team of Tencent
    Xuanwu Lab and Atuin Automated Vulnerability Discovery Engine for reporting
    the issue. CVE-2026-26007
  * Support for SECT* binary elliptic curves is deprecated and will be removed
    in the next release.
- Update to 46.0.4
  * Dropped support for win_arm64 wheels.
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.5.
- Update to 46.0.3
  * Fixed compilation when using LibreSSL 4.2.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1774612800">- update to 46.0.6 (CVE-2026-34073, bsc#1260876):
  * SECURITY ISSUE: Fixed a bug where name constraints were not
    applied to peer names during verification when the leaf
    certificate contains a wildcard DNS SAN. Ordinary X.509
    topologies are not affected by this bug, including those used
    by the Web PKI. Credit to Oleh Konko (1seal) for reporting
    the issue. CVE-2026-34073</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1774958400">- Add patch support-maturin-1.12.patch:
  * Correctly deal with maturin bugfix that installs tests and
    docs under sitearch.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1775822400">- Update to 46.0.7 (fixes CVE-2026-39892, bsc#1261863)
  * **SECURITY ISSUE**: Fixed an issue where non-contiguous buffers could be
    passed to APIs that accept Python buffers, which could lead to buffer
    overflow. **CVE-2026-39892**
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.6.
- drop support-maturin-1.12.patch (upstream)
- drop no-pytest_benchmark.patch,
  Make-unsafe-subinterpreter-support-available-via-cfg.patch:
  obsolete</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1777204800">- update to 47.0.0:
  * Support for Python 3.8 is deprecated and will be removed in
    the next cryptography release.
  * BACKWARDS INCOMPATIBLE: Support for binary elliptic curves
    (SECT* classes) has been removed. These curves are rarely
    used and have additional security considerations that make
    them undesirable.
  * BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.1.x has been
    removed. OpenSSL 3.0.0 or later is now required. LibreSSL,
    BoringSSL, and AWS-LC continue to be supported.
  * BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL &lt; 4.1.
  * BACKWARDS INCOMPATIBLE: Loading keys with unsupported
    algorithms or keys with unsupported explicit curve encodings
    now raises
    :class:`~cryptography.exceptions.UnsupportedAlgorithm`
    instead of ValueError. This change affects :func:`~cryptograp
    hy.hazmat.primitives.serialization.load_pem_private_key`, :fu
    nc:`~cryptography.hazmat.primitives.serialization.load_der_pr
    ivate_key`, :func:`~cryptography.hazmat.primitives.serializat
    ion.load_pem_public_key`, :func:`~cryptography.hazmat.primiti
    ves.serialization.load_der_public_key`, and
    :meth:`~cryptography.x509.Certificate.public_key` when called
    on certificates with unsupported public key algorithms.
  * BACKWARDS INCOMPATIBLE: When parsing elliptic curve private
    keys, we now reject keys that incorrectly encode a private
    key of the wrong length because such keys are impossible to
    process in a constant-time manner. We do not believe keys
    with this problem are in wide use, however we may revert this
    change based on the feedback we receive.
  * Deprecated passing 64-bit (8-byte) and 128-bit (16-byte) keys
    to :class:`~cryptography.hazmat.decrepit.ciphers.algorithms.T
    ripleDES`. In a future release, only 192-bit (24-byte) keys
    will be accepted. Users should expand shorter keys themselves
    (e.g., for single DES: key + key + key, for two-key: key +
    key[:8]).
  * Updated the minimum supported Rust version (MSRV) to 1.83.0,
    from 1.74.0.
  * Support for x86_64 macOS (including publishing wheels) is
    deprecated and will be removed in the next release. We will
    switch to publishing an arm64 only wheel for macOS.
  * Support for 32-bit Windows (including publishing wheels) is
    deprecated and will be removed in the next release. Users
    should move to a 64-bit Python installation.
  * public_bytes and private_bytes methods on keys now raise
    TypeError (instead of ValueError) if an invalid encoding is
    provided for the given format.
  * Moved
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.CFB`,
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.OFB`, and
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.CFB8`
    into :doc:`/hazmat/decrepit/index` and deprecated them in the
    modes module. They will be removed from the modes module in
    49.0.0.
  * Moved :class:`~cryptography.hazmat.primitives.ciphers.algorit
    hms.Camellia` into  :doc:`/hazmat/decrepit/index` and
    deprecated it in the cipher module. It will be removed from
    the cipher module in 49.0.0.
  * Added
    :meth:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF.extract`
    to :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF`.
    The previous private implementation will be removed in
    49.0.0.
  * Added support for loading elliptic curve keys that contain
    explicit encodings of the curves secp256r1, secp384r1, and
    secp521r1.
  * Added support for
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2d`
    and
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2i`
    when using OpenSSL 3.2.0+.
  * Added derive_into methods to
    :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF`,
    :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDFExpand`,
    :class:`~cryptography.hazmat.primitives.kdf.concatkdf.ConcatK
    DFHash`, :class:`~cryptography.hazmat.primitives.kdf.concatkd
    f.ConcatKDFHMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2id`,
    :class:`~cryptography.hazmat.primitives.kdf.pbkdf2.PBKDF2HMAC
    `,
    :class:`~cryptography.hazmat.primitives.kdf.kbkdf.KBKDFHMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.kbkdf.KBKDFCMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.scrypt.Scrypt`,
    and
    :class:`~cryptography.hazmat.primitives.kdf.x963kdf.X963KDF`
    to allow deriving keys directly into pre-allocated buffers.
  * Added encrypt_into and decrypt_into methods to
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESCCM`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESGCM`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESGCMSI
    V`, :class:`~cryptography.hazmat.primitives.ciphers.aead.AESO
    CB3`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESSIV`,
    and :class:`~cryptography.hazmat.primitives.ciphers.aead.ChaC
    ha20Poly1305` to allow encrypting directly into a pre-
    allocated buffer.
  * Added support for PKCS1v15 signing without DigestInfo using :
    class:`~cryptography.hazmat.primitives.asymmetric.utils.NoDig
    estInfo`.
  * Added
    :meth:`~cryptography.hazmat.primitives.hashes.Hash.hash`, a
    one-shot method for computing hashes.
  * Added :doc:`/hazmat/primitives/hpke` support implementing RFC
    9180 for hybrid authenticated encryption.
  * Added new :doc:`/hazmat/primitives/asymmetric/mlkem` module
    with support for ML-KEM key encapsulation with AWS-LC and
    BoringSSL. Note: Post-quantum algorithm support requires AWS-
    LC or BoringSSL. As we ship our wheels with OpenSSL, most
    users will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Note: Post-quantum algorithm support requires AWS-LC or
    BoringSSL. As we ship our wheels with OpenSSL, most users
    will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Added new :doc:`/hazmat/primitives/asymmetric/mldsa` module
    with support for ML-DSA signing and verification with AWS-LC
    and BoringSSL. Note: Post-quantum algorithm support requires
    AWS-LC or BoringSSL. As we ship our wheels with OpenSSL, most
    users will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Note: Post-quantum algorithm support requires AWS-LC or
    BoringSSL. As we ship our wheels with OpenSSL, most users
    will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Added new :doc:`/hazmat/asn1/index` module with support for
    declaratively defining custom ASN.1 types and
    encoding/decoding them.
  * Fixed compilation when using LibreSSL 4.3.0 and OpenSSL
    4.0.0.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 4.0.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1778414400">- update to 48.0.0:
  * BACKWARDS INCOMPATIBLE: Support for Python 3.8 has been
    removed. cryptography now requires Python 3.9 or later.
  * BACKWARDS INCOMPATIBLE: Loading an X.509 CRL whose inner
    TBSCertList.signature algorithm does not match the outer
    signatureAlgorithm now raises ValueError. Previously, such
    CRLs were parsed successfully and only rejected during
    signature validation.
  * Added support for :doc:`/hazmat/primitives/asymmetric/mlkem`
    and :doc:`/hazmat/primitives/asymmetric/mldsa` when using
    OpenSSL 3.5.0 or later, in addition to the existing AWS-LC
    and BoringSSL support. This means post-quantum algorithms are
    now available to users of our wheels. Note: Going forward, we
    do not guarantee that all functionality in cryptography will
    be available when building against OpenSSL. See
    :doc:`/statements/state-of-openssl` for more information.
  * Note: Going forward, we do not guarantee that all
    functionality in cryptography will be available when building
    against OpenSSL. See :doc:`/statements/state-of-openssl` for
    more information.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1781438400">- update to 49.0.0:
  * BACKWARDS INCOMPATIBLE: Removed the deprecated
    PUBLIC_KEY_TYPES, PRIVATE_KEY_TYPES,
    CERTIFICATE_PRIVATE_KEY_TYPES,
    CERTIFICATE_ISSUER_PUBLIC_KEY_TYPES, and
    CERTIFICATE_PUBLIC_KEY_TYPES type aliases. Use
    PublicKeyTypes, PrivateKeyTypes,
    CertificateIssuerPrivateKeyTypes,
    CertificateIssuerPublicKeyTypes, and
    CertificatePublicKeyTypes instead. These were deprecated in
    version 40.0.
  * BACKWARDS INCOMPATIBLE: :class:`~cryptography.hazmat.primitiv
    es.ciphers.algorithms.ChaCha20` now treats the first 4 bytes
    of the nonce as a 32-bit little-endian block counter (as
    defined in RFC 7539) and tracks the number of bytes
    processed. Attempting to encrypt or decrypt more data than
    the counter allows before it would overflow now raises a
    :class:`ValueError` rather than silently diverging from RFC
    7539. Setting the counter portion of the nonce to zero allows
    encrypting up to 256 GiB with a given nonce.
  * BACKWARDS INCOMPATIBLE: Loading an X.509 certificate whose
    ECDSA or DSA signature AlgorithmIdentifier contains encoded
    NULL parameters now raises a :class:`ValueError`. Such
    certificates are invalid, but older versions of Java emitted
    them; previously they loaded with a deprecation warning.
  * Fixed cross-compilation of the CFFI bindings when
    PYO3_CROSS_LIB_DIR is set. The build now derives the Python
    include directory from PYO3_CROSS_LIB_DIR instead of querying
    the host interpreter, which previously caused the build to
    fail during cross-compilations for embedded systems, on hosts
    which have same-version Python development headers installed
    as the target Python.
  * Added support for signing and verifying X.509 certificates,
    certificate signing requests, and certificate revocation
    lists with :doc:`/hazmat/primitives/asymmetric/mldsa` keys,
    as well as loading certificates that contain ML-DSA public
    keys.
  * Added
    :meth:`~cryptography.hazmat.primitives.hpke.KEM.enc_length`
    to :class:`~cryptography.hazmat.primitives.hpke.KEM` so
    callers can split the encapsulated key from the ciphertext
    returned by
    :meth:`~cryptography.hazmat.primitives.hpke.Suite.encrypt`.
  * :meth:`~cryptography.x509.verification.ExtensionPolicy.requir
    e_present`, :meth:`~cryptography.x509.verification.ExtensionP
    olicy.may_be_present`, and :meth:`~cryptography.x509.verifica
    tion.ExtensionPolicy.require_not_present` now accept any
    extension type. Previously only a fixed set of extension
    types was supported, which made it impossible to account for
    otherwise unrecognized critical extensions during path
    validation.
  * Added support for using
    :class:`~cryptography.x509.Certificate`,
    :class:`~cryptography.x509.CertificateSigningRequest`, and
    :class:`~cryptography.x509.CertificateRevocationList` as
    field types in :doc:`/hazmat/asn1/index` structures.
  * Added :func:`~cryptography.hazmat.asn1.value_set`, a class
    decorator that registers an :class:`enum.Enum` subclass as an
    ASN.1 value set: members are encoded as their underlying
    value, and decoding fails if the decoded value does not match
    one of the declared members.
  * Added :meth:`~cryptography.x509.Name.from_bytes` for parsing
    a :class:`~cryptography.x509.Name` from DER bytes, the
    inverse of :meth:`~cryptography.x509.Name.public_bytes`.
  * Added the rsa_padding keyword-only parameter to
    :meth:`~cryptography.x509.CertificateBuilder.public_key`.
    Passing the :class:`~cryptography.hazmat.primitives.asymmetri
    c.padding.PSS` class (not an instance) encodes an RSA subject
    public key in the certificate's subjectPublicKeyInfo with the
    id-RSASSA-PSS OID and no parameters.
  * Added external mu (message representative) support to
    :doc:`/hazmat/primitives/asymmetric/mldsa` via the sign_mu
    and verify_mu methods, which sign and verify a precomputed
    64-byte mu as defined in FIPS 204.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 4.0.1.</changelog>
</package>
<package pkgid="dbc5c49cf6a41e0eacc4545dbc5001c21a6818585b5c2fa9f28361fcedf05bc775168588df5a40cc60b6ad6f3e0cf1a542fa597c1acfc2d7d2e8dd9abc9ffa1d" name="python314-cryptography-debuginfo" arch="aarch64">
  <version epoch="0" ver="49.0.0" rel="289.3"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1727524800">- update to 43.0.1:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.3.2.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1729598400">- update to 43.0.3:
  * Fixed release metadata for cryptography-vectors
  * Fixed compilation when using LibreSSL 4.0.0.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1730808000">- Avoid using requires_eq, which after the last modifications
  conflicts with python singlespec (order of expansion).</changelog>
  <changelog author="Ben Greiner &lt;code@bnavigator.de&gt;" date="1731067200">- Fix requires_eq replacement for distributions which do not have
  python3-cffi installed (such as SLE15 python module pythons)
  * gh#openSUSE/python-rpm-macros#185
- Remove outdated section in description</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfyhalomacro@opensuse.org&gt;" date="1737892800">- Update to version 44.0.0:
  * BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL &lt; 3.9.
  * Deprecated Python 3.7 support. Python 3.7 is no longer supported by
    the Python core team. Support for Python 3.7 will be removed in a future
    cryptography release.
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.4.0.
  * macOS wheels are now built against the macOS 10.13 SDK. Users on older
    versions of macOS should upgrade, or they will need to build cryptography
    themselves.
  * Enforce the RFC 5280 requirement that extended key usage extensions must not be empty.
  * Added support for timestamp extraction to the :class:`~cryptography.fernet.MultiFernet` class.
  * Relax the Authority Key Identifier requirements on root CA certificates
    during X.509 verification to allow fields permitted by RFC 5280 but
    forbidden by the CA/Browser BRs.
  * Added support for
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2id` when using
    OpenSSL 3.2.0+.
  * Added support for the :class:`~cryptography.x509.Admissions` certificate extension.
  * Added basic support for PKCS7 decryption (including S/MIME 3.2) via
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der`,
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_pem`,
    and :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_smime`.
- Update specfile to accommodate new project structure at version 44.0.0
- Update no-pytest_benchmark.patch</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1740571200">- update to 44.0.1:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.4.1.
  * We now build armv7l manylinux wheels and publish them to
    PyPI.
  * We now build manylinux_2_34 wheels and publish them to PyPI.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1742731200">- update to 44.0.2:
  * We now build wheels for PyPy 3.11.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1746619200">- Update to 44.0.3
  * Fixed compilation when using LibreSSL 4.1.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1752321600">- update to 45.0.5:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.1.
  * Fixed decrypting PKCS#8 files encrypted with SHA1-RC4. (This
    is not considered secure, and is supported only for backwards
    compatibility.)
  * Fixed decrypting PKCS#8 files encrypted with long salts (this
    impacts keys encrypted by Bouncy Castle).
  * Fixed decrypting PKCS#8 files encrypted with DES-CBC-MD5.
    While wildly insecure, this remains prevalent.
  * Fixed using mypy with cryptography on older versions of
    Python.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.0.
  * Support for Python 3.7 is deprecated and will be removed in
    the next cryptography release.
  * Updated the minimum supported Rust version (MSRV) to 1.74.0,
    from 1.65.0.
  * Added support for serialization of PKCS#12 Java truststores
    in :func:`~cryptography.hazmat.primitives.serialization.pkcs1
    2.serialize_java_truststore`
  * Added :meth:`~cryptography.hazmat.primitives.kdf.argon2.Argon
    2id.derive_phc_encoded` and :meth:`~cryptography.hazmat.primi
    tives.kdf.argon2.Argon2id.verify_phc_encoded` methods to
    support password hashing in the PHC string format
  * Added support for PKCS7 decryption and encryption using
    AES-256 as the content algorithm, in addition to AES-128.
  * BACKWARDS INCOMPATIBLE: Made SSH private key loading more
    consistent with other private key loading: :func:`~cryptograp
    hy.hazmat.primitives.serialization.load_ssh_private_key` now
    raises a TypeError if the key is unencrypted but a password
    is provided (previously no exception was raised), and raises
    a TypeError if the key is encrypted but no password is
    provided (previously a ValueError was raised).
  * Added __copy__ to the :class:`~cryptography.hazmat.primitives
    .asymmetric.ec.EllipticCurvePrivateKey`, :class:`~cryptograph
    y.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey`, :c
    lass:`~cryptography.hazmat.primitives.asymmetric.ed25519.Ed25
    519PublicKey`, :class:`~cryptography.hazmat.primitives.asymme
    tric.ed25519.Ed25519PrivateKey`, :class:`~cryptography.hazmat
    .primitives.asymmetric.ed448.Ed448PublicKey`, :class:`~crypto
    graphy.hazmat.primitives.asymmetric.ed448.Ed448PrivateKey`, :
    class:`~cryptography.hazmat.primitives.asymmetric.x25519.X255
    19PublicKey`, :class:`~cryptography.hazmat.primitives.asymmet
    ric.x25519.X25519PrivateKey`, :class:`~cryptography.hazmat.pr
    imitives.asymmetric.x448.X448PublicKey`, :class:`~cryptograph
    y.hazmat.primitives.asymmetric.x448.X448PrivateKey`, :class:`
    ~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey`
    , :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAP
    ublicKey`, :class:`~cryptography.hazmat.primitives.asymmetric
    .dsa.DSAPrivateKey`, :class:`~cryptography.hazmat.primitives.
    asymmetric.dsa.DSAPublicKey`, :class:`~cryptography.hazmat.pr
    imitives.asymmetric.dh.DHPrivateKey`, and :class:`~cryptograp
    hy.hazmat.primitives.asymmetric.dh.DHPublicKey` abstract base
    classes.
  * We significantly refactored how private key loading ( :func:`
    ~cryptography.hazmat.primitives.serialization.load_pem_privat
    e_key` and :func:`~cryptography.hazmat.primitives.serializati
    on.load_der_private_key`) works. This is intended to be
    backwards compatible for all well-formed keys, therefore if
    you discover a key that now raises an exception, please file
    a bug with instructions for reproducing.
  * Added unsafe_skip_rsa_key_validation keyword-argument to :fun
    c:`~cryptography.hazmat.primitives.serialization.load_ssh_pri
    vate_key`.
  * Added :class:`~cryptography.hazmat.primitives.hashes.XOFHash`
    to support repeated :meth:`~cryptography.hazmat.primitives.ha
    shes.XOFHash.squeeze` operations on extendable output
    functions.
  * Added :meth:`~cryptography.x509.ocsp.OCSPResponseBuilder.add_
    response_by_hash` method to allow creating OCSP responses
    using certificate hash values rather than full certificates.
  * Extended the :mod:`X.509 path validation
    &lt;cryptography.x509.verification&gt;` API to support user-
    configured extension policies via the
    :meth:`PolicyBuilder.extension_policies &lt;cryptography.x509.ve
    rification.PolicyBuilder.extension_policies&gt;` method.
  * Deprecated the subject, verification_time and max_chain_depth
    properties on
    :class:`~cryptography.x509.verification.ClientVerifier` and
    :class:`~cryptography.x509.verification.ServerVerifier` in
    favor of a new policy property. These properties will be
    removed in the next release of cryptography.
  * BACKWARDS INCOMPATIBLE: The :meth:`VerifiedClient.subject
    &lt;cryptography.x509.verification.VerifiedClient.subjects&gt;`
    property can now be None since a custom extension policy may
    allow certificates without a Subject Alternative Name
    extension.
  * Changed the behavior when the OpenSSL 3 legacy provider fails
    to load. Instead of raising an exception, a warning is now
    emitted. The CRYPTOGRAPHY_OPENSSL_NO_LEGACY environment
    variable can still be used to disable the legacy provider at
    runtime.
  * Added support for the CRYPTOGRAPHY_BUILD_OPENSSL_NO_LEGACY
    environment variable during build time, which prevents the
    library from ever attempting to load the legacy provider.
  * Added support for the
    :class:`~cryptography.x509.PrivateKeyUsagePeriod` X.509
    extension. This extension defines the period during which the
    private key corresponding to the certificate's public key may
    be used.
  * Added support for compiling against `aws-lc`_.
  * Parsing X.509 structures now more strictly enforces that Name
    structures do not have malformed ASN.1.
  * We now publish py311 wheels that utilize the faster
    pyo3::buffer::PyBuffer interface, resulting in significantly
    improved performance for operations involving small buffers.
  * Added :func:`~cryptography.hazmat.primitives.serialization.ss
    h_key_fingerprint` for computing fingerprints of SSH public
    keys.
  * Added support for deterministic ECDSA signing via the new
    keyword-only argument ecdsa_deterministic in
    :meth:`~cryptography.x509.CertificateBuilder.sign`, :meth:`~c
    ryptography.x509.CertificateRevocationListBuilder.sign` and :
    meth:`~cryptography.x509.CertificateSigningRequestBuilder.sig
    n`.</changelog>
  <changelog author="James Oakley &lt;jfunk@opensuse.org&gt;" date="1756728000">- Add Make-unsafe-subinterpreter-support-available-via-cfg.patch
  to allow ceph-mgr to load modules (boo#1248987)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1757851200">- update to 45.0.7:
  * Added a function to support an upcoming pyOpenSSL release.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1760356800">- update to 46.0.2:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.4.
  * Fixed an issue where users installing via pip on Python 3.14
    development versions would not properly install a dependency.
  * Fixed an issue building the free-threaded macOS 3.14 wheels.
  * BACKWARDS INCOMPATIBLE: Support for Python 3.7 has been
    removed.
  * Support for OpenSSL &lt; 3.0 is deprecated and will be removed
    in the next release.
  * Support for x86_64 macOS (including publishing wheels) is
    deprecated and will be removed in two releases. We will
    switch to publishing an arm64 only wheel for macOS.
  * Support for 32-bit Windows (including publishing wheels) is
    deprecated and will be removed in two releases. Users should
    move to a 64-bit Python installation.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.3.
  * We now build ppc64le manylinux wheels and publish them to
    PyPI.
  * We now build win_arm64 (Windows on Arm) wheels and publish
    them to PyPI.
  * Added support for free-threaded Python 3.14.
  * Removed the deprecated get_attribute_for_oid method on
    :class:`~cryptography.x509.CertificateSigningRequest`. Users
    should use
    :meth:`~cryptography.x509.Attributes.get_attribute_for_oid`
    instead.
  * Removed the deprecated CAST5, SEED, IDEA, and Blowfish
    classes from the cipher module. These are still available in
    :doc:`/hazmat/decrepit/index`.
  * In X.509, when performing a PSS signature with a SHA-3 hash,
    it is now encoded with the official NIST SHA3 OID.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1765195200">- Only require pytest-subtests with pytest &lt; 9.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1770897600">- Update to 46.0.5 (fixes CVE-2026-26007, bsc#1258074)
  * An attacker could create a malicious public key that reveals portions of
    your private key when using certain uncommon elliptic curves (binary
    curves). This version now includes additional security checks to prevent
    this attack. This issue only affects binary elliptic curves, which are
    rarely used in real-world applications. Credit to XlabAI Team of Tencent
    Xuanwu Lab and Atuin Automated Vulnerability Discovery Engine for reporting
    the issue. CVE-2026-26007
  * Support for SECT* binary elliptic curves is deprecated and will be removed
    in the next release.
- Update to 46.0.4
  * Dropped support for win_arm64 wheels.
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.5.
- Update to 46.0.3
  * Fixed compilation when using LibreSSL 4.2.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1774612800">- update to 46.0.6 (CVE-2026-34073, bsc#1260876):
  * SECURITY ISSUE: Fixed a bug where name constraints were not
    applied to peer names during verification when the leaf
    certificate contains a wildcard DNS SAN. Ordinary X.509
    topologies are not affected by this bug, including those used
    by the Web PKI. Credit to Oleh Konko (1seal) for reporting
    the issue. CVE-2026-34073</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1774958400">- Add patch support-maturin-1.12.patch:
  * Correctly deal with maturin bugfix that installs tests and
    docs under sitearch.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1775822400">- Update to 46.0.7 (fixes CVE-2026-39892, bsc#1261863)
  * **SECURITY ISSUE**: Fixed an issue where non-contiguous buffers could be
    passed to APIs that accept Python buffers, which could lead to buffer
    overflow. **CVE-2026-39892**
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.6.
- drop support-maturin-1.12.patch (upstream)
- drop no-pytest_benchmark.patch,
  Make-unsafe-subinterpreter-support-available-via-cfg.patch:
  obsolete</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1777204800">- update to 47.0.0:
  * Support for Python 3.8 is deprecated and will be removed in
    the next cryptography release.
  * BACKWARDS INCOMPATIBLE: Support for binary elliptic curves
    (SECT* classes) has been removed. These curves are rarely
    used and have additional security considerations that make
    them undesirable.
  * BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.1.x has been
    removed. OpenSSL 3.0.0 or later is now required. LibreSSL,
    BoringSSL, and AWS-LC continue to be supported.
  * BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL &lt; 4.1.
  * BACKWARDS INCOMPATIBLE: Loading keys with unsupported
    algorithms or keys with unsupported explicit curve encodings
    now raises
    :class:`~cryptography.exceptions.UnsupportedAlgorithm`
    instead of ValueError. This change affects :func:`~cryptograp
    hy.hazmat.primitives.serialization.load_pem_private_key`, :fu
    nc:`~cryptography.hazmat.primitives.serialization.load_der_pr
    ivate_key`, :func:`~cryptography.hazmat.primitives.serializat
    ion.load_pem_public_key`, :func:`~cryptography.hazmat.primiti
    ves.serialization.load_der_public_key`, and
    :meth:`~cryptography.x509.Certificate.public_key` when called
    on certificates with unsupported public key algorithms.
  * BACKWARDS INCOMPATIBLE: When parsing elliptic curve private
    keys, we now reject keys that incorrectly encode a private
    key of the wrong length because such keys are impossible to
    process in a constant-time manner. We do not believe keys
    with this problem are in wide use, however we may revert this
    change based on the feedback we receive.
  * Deprecated passing 64-bit (8-byte) and 128-bit (16-byte) keys
    to :class:`~cryptography.hazmat.decrepit.ciphers.algorithms.T
    ripleDES`. In a future release, only 192-bit (24-byte) keys
    will be accepted. Users should expand shorter keys themselves
    (e.g., for single DES: key + key + key, for two-key: key +
    key[:8]).
  * Updated the minimum supported Rust version (MSRV) to 1.83.0,
    from 1.74.0.
  * Support for x86_64 macOS (including publishing wheels) is
    deprecated and will be removed in the next release. We will
    switch to publishing an arm64 only wheel for macOS.
  * Support for 32-bit Windows (including publishing wheels) is
    deprecated and will be removed in the next release. Users
    should move to a 64-bit Python installation.
  * public_bytes and private_bytes methods on keys now raise
    TypeError (instead of ValueError) if an invalid encoding is
    provided for the given format.
  * Moved
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.CFB`,
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.OFB`, and
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.CFB8`
    into :doc:`/hazmat/decrepit/index` and deprecated them in the
    modes module. They will be removed from the modes module in
    49.0.0.
  * Moved :class:`~cryptography.hazmat.primitives.ciphers.algorit
    hms.Camellia` into  :doc:`/hazmat/decrepit/index` and
    deprecated it in the cipher module. It will be removed from
    the cipher module in 49.0.0.
  * Added
    :meth:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF.extract`
    to :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF`.
    The previous private implementation will be removed in
    49.0.0.
  * Added support for loading elliptic curve keys that contain
    explicit encodings of the curves secp256r1, secp384r1, and
    secp521r1.
  * Added support for
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2d`
    and
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2i`
    when using OpenSSL 3.2.0+.
  * Added derive_into methods to
    :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF`,
    :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDFExpand`,
    :class:`~cryptography.hazmat.primitives.kdf.concatkdf.ConcatK
    DFHash`, :class:`~cryptography.hazmat.primitives.kdf.concatkd
    f.ConcatKDFHMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2id`,
    :class:`~cryptography.hazmat.primitives.kdf.pbkdf2.PBKDF2HMAC
    `,
    :class:`~cryptography.hazmat.primitives.kdf.kbkdf.KBKDFHMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.kbkdf.KBKDFCMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.scrypt.Scrypt`,
    and
    :class:`~cryptography.hazmat.primitives.kdf.x963kdf.X963KDF`
    to allow deriving keys directly into pre-allocated buffers.
  * Added encrypt_into and decrypt_into methods to
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESCCM`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESGCM`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESGCMSI
    V`, :class:`~cryptography.hazmat.primitives.ciphers.aead.AESO
    CB3`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESSIV`,
    and :class:`~cryptography.hazmat.primitives.ciphers.aead.ChaC
    ha20Poly1305` to allow encrypting directly into a pre-
    allocated buffer.
  * Added support for PKCS1v15 signing without DigestInfo using :
    class:`~cryptography.hazmat.primitives.asymmetric.utils.NoDig
    estInfo`.
  * Added
    :meth:`~cryptography.hazmat.primitives.hashes.Hash.hash`, a
    one-shot method for computing hashes.
  * Added :doc:`/hazmat/primitives/hpke` support implementing RFC
    9180 for hybrid authenticated encryption.
  * Added new :doc:`/hazmat/primitives/asymmetric/mlkem` module
    with support for ML-KEM key encapsulation with AWS-LC and
    BoringSSL. Note: Post-quantum algorithm support requires AWS-
    LC or BoringSSL. As we ship our wheels with OpenSSL, most
    users will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Note: Post-quantum algorithm support requires AWS-LC or
    BoringSSL. As we ship our wheels with OpenSSL, most users
    will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Added new :doc:`/hazmat/primitives/asymmetric/mldsa` module
    with support for ML-DSA signing and verification with AWS-LC
    and BoringSSL. Note: Post-quantum algorithm support requires
    AWS-LC or BoringSSL. As we ship our wheels with OpenSSL, most
    users will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Note: Post-quantum algorithm support requires AWS-LC or
    BoringSSL. As we ship our wheels with OpenSSL, most users
    will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Added new :doc:`/hazmat/asn1/index` module with support for
    declaratively defining custom ASN.1 types and
    encoding/decoding them.
  * Fixed compilation when using LibreSSL 4.3.0 and OpenSSL
    4.0.0.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 4.0.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1778414400">- update to 48.0.0:
  * BACKWARDS INCOMPATIBLE: Support for Python 3.8 has been
    removed. cryptography now requires Python 3.9 or later.
  * BACKWARDS INCOMPATIBLE: Loading an X.509 CRL whose inner
    TBSCertList.signature algorithm does not match the outer
    signatureAlgorithm now raises ValueError. Previously, such
    CRLs were parsed successfully and only rejected during
    signature validation.
  * Added support for :doc:`/hazmat/primitives/asymmetric/mlkem`
    and :doc:`/hazmat/primitives/asymmetric/mldsa` when using
    OpenSSL 3.5.0 or later, in addition to the existing AWS-LC
    and BoringSSL support. This means post-quantum algorithms are
    now available to users of our wheels. Note: Going forward, we
    do not guarantee that all functionality in cryptography will
    be available when building against OpenSSL. See
    :doc:`/statements/state-of-openssl` for more information.
  * Note: Going forward, we do not guarantee that all
    functionality in cryptography will be available when building
    against OpenSSL. See :doc:`/statements/state-of-openssl` for
    more information.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1781438400">- update to 49.0.0:
  * BACKWARDS INCOMPATIBLE: Removed the deprecated
    PUBLIC_KEY_TYPES, PRIVATE_KEY_TYPES,
    CERTIFICATE_PRIVATE_KEY_TYPES,
    CERTIFICATE_ISSUER_PUBLIC_KEY_TYPES, and
    CERTIFICATE_PUBLIC_KEY_TYPES type aliases. Use
    PublicKeyTypes, PrivateKeyTypes,
    CertificateIssuerPrivateKeyTypes,
    CertificateIssuerPublicKeyTypes, and
    CertificatePublicKeyTypes instead. These were deprecated in
    version 40.0.
  * BACKWARDS INCOMPATIBLE: :class:`~cryptography.hazmat.primitiv
    es.ciphers.algorithms.ChaCha20` now treats the first 4 bytes
    of the nonce as a 32-bit little-endian block counter (as
    defined in RFC 7539) and tracks the number of bytes
    processed. Attempting to encrypt or decrypt more data than
    the counter allows before it would overflow now raises a
    :class:`ValueError` rather than silently diverging from RFC
    7539. Setting the counter portion of the nonce to zero allows
    encrypting up to 256 GiB with a given nonce.
  * BACKWARDS INCOMPATIBLE: Loading an X.509 certificate whose
    ECDSA or DSA signature AlgorithmIdentifier contains encoded
    NULL parameters now raises a :class:`ValueError`. Such
    certificates are invalid, but older versions of Java emitted
    them; previously they loaded with a deprecation warning.
  * Fixed cross-compilation of the CFFI bindings when
    PYO3_CROSS_LIB_DIR is set. The build now derives the Python
    include directory from PYO3_CROSS_LIB_DIR instead of querying
    the host interpreter, which previously caused the build to
    fail during cross-compilations for embedded systems, on hosts
    which have same-version Python development headers installed
    as the target Python.
  * Added support for signing and verifying X.509 certificates,
    certificate signing requests, and certificate revocation
    lists with :doc:`/hazmat/primitives/asymmetric/mldsa` keys,
    as well as loading certificates that contain ML-DSA public
    keys.
  * Added
    :meth:`~cryptography.hazmat.primitives.hpke.KEM.enc_length`
    to :class:`~cryptography.hazmat.primitives.hpke.KEM` so
    callers can split the encapsulated key from the ciphertext
    returned by
    :meth:`~cryptography.hazmat.primitives.hpke.Suite.encrypt`.
  * :meth:`~cryptography.x509.verification.ExtensionPolicy.requir
    e_present`, :meth:`~cryptography.x509.verification.ExtensionP
    olicy.may_be_present`, and :meth:`~cryptography.x509.verifica
    tion.ExtensionPolicy.require_not_present` now accept any
    extension type. Previously only a fixed set of extension
    types was supported, which made it impossible to account for
    otherwise unrecognized critical extensions during path
    validation.
  * Added support for using
    :class:`~cryptography.x509.Certificate`,
    :class:`~cryptography.x509.CertificateSigningRequest`, and
    :class:`~cryptography.x509.CertificateRevocationList` as
    field types in :doc:`/hazmat/asn1/index` structures.
  * Added :func:`~cryptography.hazmat.asn1.value_set`, a class
    decorator that registers an :class:`enum.Enum` subclass as an
    ASN.1 value set: members are encoded as their underlying
    value, and decoding fails if the decoded value does not match
    one of the declared members.
  * Added :meth:`~cryptography.x509.Name.from_bytes` for parsing
    a :class:`~cryptography.x509.Name` from DER bytes, the
    inverse of :meth:`~cryptography.x509.Name.public_bytes`.
  * Added the rsa_padding keyword-only parameter to
    :meth:`~cryptography.x509.CertificateBuilder.public_key`.
    Passing the :class:`~cryptography.hazmat.primitives.asymmetri
    c.padding.PSS` class (not an instance) encodes an RSA subject
    public key in the certificate's subjectPublicKeyInfo with the
    id-RSASSA-PSS OID and no parameters.
  * Added external mu (message representative) support to
    :doc:`/hazmat/primitives/asymmetric/mldsa` via the sign_mu
    and verify_mu methods, which sign and verify a precomputed
    64-byte mu as defined in FIPS 204.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 4.0.1.</changelog>
</package>
<package pkgid="8c3d294afa88b105e44b321902bbc1b1f1a01661e3b42885078b283567e20e79bc3c6171b98e061daf3634bd2306f65b781715eb8046ee64e7e96f2eff5db471" name="python314-cryptography-debuginfo" arch="armv7hl">
  <version epoch="0" ver="49.0.0" rel="289.3"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1727524800">- update to 43.0.1:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.3.2.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1729598400">- update to 43.0.3:
  * Fixed release metadata for cryptography-vectors
  * Fixed compilation when using LibreSSL 4.0.0.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1730808000">- Avoid using requires_eq, which after the last modifications
  conflicts with python singlespec (order of expansion).</changelog>
  <changelog author="Ben Greiner &lt;code@bnavigator.de&gt;" date="1731067200">- Fix requires_eq replacement for distributions which do not have
  python3-cffi installed (such as SLE15 python module pythons)
  * gh#openSUSE/python-rpm-macros#185
- Remove outdated section in description</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfyhalomacro@opensuse.org&gt;" date="1737892800">- Update to version 44.0.0:
  * BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL &lt; 3.9.
  * Deprecated Python 3.7 support. Python 3.7 is no longer supported by
    the Python core team. Support for Python 3.7 will be removed in a future
    cryptography release.
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.4.0.
  * macOS wheels are now built against the macOS 10.13 SDK. Users on older
    versions of macOS should upgrade, or they will need to build cryptography
    themselves.
  * Enforce the RFC 5280 requirement that extended key usage extensions must not be empty.
  * Added support for timestamp extraction to the :class:`~cryptography.fernet.MultiFernet` class.
  * Relax the Authority Key Identifier requirements on root CA certificates
    during X.509 verification to allow fields permitted by RFC 5280 but
    forbidden by the CA/Browser BRs.
  * Added support for
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2id` when using
    OpenSSL 3.2.0+.
  * Added support for the :class:`~cryptography.x509.Admissions` certificate extension.
  * Added basic support for PKCS7 decryption (including S/MIME 3.2) via
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der`,
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_pem`,
    and :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_smime`.
- Update specfile to accommodate new project structure at version 44.0.0
- Update no-pytest_benchmark.patch</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1740571200">- update to 44.0.1:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.4.1.
  * We now build armv7l manylinux wheels and publish them to
    PyPI.
  * We now build manylinux_2_34 wheels and publish them to PyPI.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1742731200">- update to 44.0.2:
  * We now build wheels for PyPy 3.11.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1746619200">- Update to 44.0.3
  * Fixed compilation when using LibreSSL 4.1.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1752321600">- update to 45.0.5:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.1.
  * Fixed decrypting PKCS#8 files encrypted with SHA1-RC4. (This
    is not considered secure, and is supported only for backwards
    compatibility.)
  * Fixed decrypting PKCS#8 files encrypted with long salts (this
    impacts keys encrypted by Bouncy Castle).
  * Fixed decrypting PKCS#8 files encrypted with DES-CBC-MD5.
    While wildly insecure, this remains prevalent.
  * Fixed using mypy with cryptography on older versions of
    Python.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.0.
  * Support for Python 3.7 is deprecated and will be removed in
    the next cryptography release.
  * Updated the minimum supported Rust version (MSRV) to 1.74.0,
    from 1.65.0.
  * Added support for serialization of PKCS#12 Java truststores
    in :func:`~cryptography.hazmat.primitives.serialization.pkcs1
    2.serialize_java_truststore`
  * Added :meth:`~cryptography.hazmat.primitives.kdf.argon2.Argon
    2id.derive_phc_encoded` and :meth:`~cryptography.hazmat.primi
    tives.kdf.argon2.Argon2id.verify_phc_encoded` methods to
    support password hashing in the PHC string format
  * Added support for PKCS7 decryption and encryption using
    AES-256 as the content algorithm, in addition to AES-128.
  * BACKWARDS INCOMPATIBLE: Made SSH private key loading more
    consistent with other private key loading: :func:`~cryptograp
    hy.hazmat.primitives.serialization.load_ssh_private_key` now
    raises a TypeError if the key is unencrypted but a password
    is provided (previously no exception was raised), and raises
    a TypeError if the key is encrypted but no password is
    provided (previously a ValueError was raised).
  * Added __copy__ to the :class:`~cryptography.hazmat.primitives
    .asymmetric.ec.EllipticCurvePrivateKey`, :class:`~cryptograph
    y.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey`, :c
    lass:`~cryptography.hazmat.primitives.asymmetric.ed25519.Ed25
    519PublicKey`, :class:`~cryptography.hazmat.primitives.asymme
    tric.ed25519.Ed25519PrivateKey`, :class:`~cryptography.hazmat
    .primitives.asymmetric.ed448.Ed448PublicKey`, :class:`~crypto
    graphy.hazmat.primitives.asymmetric.ed448.Ed448PrivateKey`, :
    class:`~cryptography.hazmat.primitives.asymmetric.x25519.X255
    19PublicKey`, :class:`~cryptography.hazmat.primitives.asymmet
    ric.x25519.X25519PrivateKey`, :class:`~cryptography.hazmat.pr
    imitives.asymmetric.x448.X448PublicKey`, :class:`~cryptograph
    y.hazmat.primitives.asymmetric.x448.X448PrivateKey`, :class:`
    ~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey`
    , :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAP
    ublicKey`, :class:`~cryptography.hazmat.primitives.asymmetric
    .dsa.DSAPrivateKey`, :class:`~cryptography.hazmat.primitives.
    asymmetric.dsa.DSAPublicKey`, :class:`~cryptography.hazmat.pr
    imitives.asymmetric.dh.DHPrivateKey`, and :class:`~cryptograp
    hy.hazmat.primitives.asymmetric.dh.DHPublicKey` abstract base
    classes.
  * We significantly refactored how private key loading ( :func:`
    ~cryptography.hazmat.primitives.serialization.load_pem_privat
    e_key` and :func:`~cryptography.hazmat.primitives.serializati
    on.load_der_private_key`) works. This is intended to be
    backwards compatible for all well-formed keys, therefore if
    you discover a key that now raises an exception, please file
    a bug with instructions for reproducing.
  * Added unsafe_skip_rsa_key_validation keyword-argument to :fun
    c:`~cryptography.hazmat.primitives.serialization.load_ssh_pri
    vate_key`.
  * Added :class:`~cryptography.hazmat.primitives.hashes.XOFHash`
    to support repeated :meth:`~cryptography.hazmat.primitives.ha
    shes.XOFHash.squeeze` operations on extendable output
    functions.
  * Added :meth:`~cryptography.x509.ocsp.OCSPResponseBuilder.add_
    response_by_hash` method to allow creating OCSP responses
    using certificate hash values rather than full certificates.
  * Extended the :mod:`X.509 path validation
    &lt;cryptography.x509.verification&gt;` API to support user-
    configured extension policies via the
    :meth:`PolicyBuilder.extension_policies &lt;cryptography.x509.ve
    rification.PolicyBuilder.extension_policies&gt;` method.
  * Deprecated the subject, verification_time and max_chain_depth
    properties on
    :class:`~cryptography.x509.verification.ClientVerifier` and
    :class:`~cryptography.x509.verification.ServerVerifier` in
    favor of a new policy property. These properties will be
    removed in the next release of cryptography.
  * BACKWARDS INCOMPATIBLE: The :meth:`VerifiedClient.subject
    &lt;cryptography.x509.verification.VerifiedClient.subjects&gt;`
    property can now be None since a custom extension policy may
    allow certificates without a Subject Alternative Name
    extension.
  * Changed the behavior when the OpenSSL 3 legacy provider fails
    to load. Instead of raising an exception, a warning is now
    emitted. The CRYPTOGRAPHY_OPENSSL_NO_LEGACY environment
    variable can still be used to disable the legacy provider at
    runtime.
  * Added support for the CRYPTOGRAPHY_BUILD_OPENSSL_NO_LEGACY
    environment variable during build time, which prevents the
    library from ever attempting to load the legacy provider.
  * Added support for the
    :class:`~cryptography.x509.PrivateKeyUsagePeriod` X.509
    extension. This extension defines the period during which the
    private key corresponding to the certificate's public key may
    be used.
  * Added support for compiling against `aws-lc`_.
  * Parsing X.509 structures now more strictly enforces that Name
    structures do not have malformed ASN.1.
  * We now publish py311 wheels that utilize the faster
    pyo3::buffer::PyBuffer interface, resulting in significantly
    improved performance for operations involving small buffers.
  * Added :func:`~cryptography.hazmat.primitives.serialization.ss
    h_key_fingerprint` for computing fingerprints of SSH public
    keys.
  * Added support for deterministic ECDSA signing via the new
    keyword-only argument ecdsa_deterministic in
    :meth:`~cryptography.x509.CertificateBuilder.sign`, :meth:`~c
    ryptography.x509.CertificateRevocationListBuilder.sign` and :
    meth:`~cryptography.x509.CertificateSigningRequestBuilder.sig
    n`.</changelog>
  <changelog author="James Oakley &lt;jfunk@opensuse.org&gt;" date="1756728000">- Add Make-unsafe-subinterpreter-support-available-via-cfg.patch
  to allow ceph-mgr to load modules (boo#1248987)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1757851200">- update to 45.0.7:
  * Added a function to support an upcoming pyOpenSSL release.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1760356800">- update to 46.0.2:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.4.
  * Fixed an issue where users installing via pip on Python 3.14
    development versions would not properly install a dependency.
  * Fixed an issue building the free-threaded macOS 3.14 wheels.
  * BACKWARDS INCOMPATIBLE: Support for Python 3.7 has been
    removed.
  * Support for OpenSSL &lt; 3.0 is deprecated and will be removed
    in the next release.
  * Support for x86_64 macOS (including publishing wheels) is
    deprecated and will be removed in two releases. We will
    switch to publishing an arm64 only wheel for macOS.
  * Support for 32-bit Windows (including publishing wheels) is
    deprecated and will be removed in two releases. Users should
    move to a 64-bit Python installation.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.3.
  * We now build ppc64le manylinux wheels and publish them to
    PyPI.
  * We now build win_arm64 (Windows on Arm) wheels and publish
    them to PyPI.
  * Added support for free-threaded Python 3.14.
  * Removed the deprecated get_attribute_for_oid method on
    :class:`~cryptography.x509.CertificateSigningRequest`. Users
    should use
    :meth:`~cryptography.x509.Attributes.get_attribute_for_oid`
    instead.
  * Removed the deprecated CAST5, SEED, IDEA, and Blowfish
    classes from the cipher module. These are still available in
    :doc:`/hazmat/decrepit/index`.
  * In X.509, when performing a PSS signature with a SHA-3 hash,
    it is now encoded with the official NIST SHA3 OID.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1765195200">- Only require pytest-subtests with pytest &lt; 9.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1770897600">- Update to 46.0.5 (fixes CVE-2026-26007, bsc#1258074)
  * An attacker could create a malicious public key that reveals portions of
    your private key when using certain uncommon elliptic curves (binary
    curves). This version now includes additional security checks to prevent
    this attack. This issue only affects binary elliptic curves, which are
    rarely used in real-world applications. Credit to XlabAI Team of Tencent
    Xuanwu Lab and Atuin Automated Vulnerability Discovery Engine for reporting
    the issue. CVE-2026-26007
  * Support for SECT* binary elliptic curves is deprecated and will be removed
    in the next release.
- Update to 46.0.4
  * Dropped support for win_arm64 wheels.
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.5.
- Update to 46.0.3
  * Fixed compilation when using LibreSSL 4.2.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1774612800">- update to 46.0.6 (CVE-2026-34073, bsc#1260876):
  * SECURITY ISSUE: Fixed a bug where name constraints were not
    applied to peer names during verification when the leaf
    certificate contains a wildcard DNS SAN. Ordinary X.509
    topologies are not affected by this bug, including those used
    by the Web PKI. Credit to Oleh Konko (1seal) for reporting
    the issue. CVE-2026-34073</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1774958400">- Add patch support-maturin-1.12.patch:
  * Correctly deal with maturin bugfix that installs tests and
    docs under sitearch.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1775822400">- Update to 46.0.7 (fixes CVE-2026-39892, bsc#1261863)
  * **SECURITY ISSUE**: Fixed an issue where non-contiguous buffers could be
    passed to APIs that accept Python buffers, which could lead to buffer
    overflow. **CVE-2026-39892**
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.6.
- drop support-maturin-1.12.patch (upstream)
- drop no-pytest_benchmark.patch,
  Make-unsafe-subinterpreter-support-available-via-cfg.patch:
  obsolete</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1777204800">- update to 47.0.0:
  * Support for Python 3.8 is deprecated and will be removed in
    the next cryptography release.
  * BACKWARDS INCOMPATIBLE: Support for binary elliptic curves
    (SECT* classes) has been removed. These curves are rarely
    used and have additional security considerations that make
    them undesirable.
  * BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.1.x has been
    removed. OpenSSL 3.0.0 or later is now required. LibreSSL,
    BoringSSL, and AWS-LC continue to be supported.
  * BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL &lt; 4.1.
  * BACKWARDS INCOMPATIBLE: Loading keys with unsupported
    algorithms or keys with unsupported explicit curve encodings
    now raises
    :class:`~cryptography.exceptions.UnsupportedAlgorithm`
    instead of ValueError. This change affects :func:`~cryptograp
    hy.hazmat.primitives.serialization.load_pem_private_key`, :fu
    nc:`~cryptography.hazmat.primitives.serialization.load_der_pr
    ivate_key`, :func:`~cryptography.hazmat.primitives.serializat
    ion.load_pem_public_key`, :func:`~cryptography.hazmat.primiti
    ves.serialization.load_der_public_key`, and
    :meth:`~cryptography.x509.Certificate.public_key` when called
    on certificates with unsupported public key algorithms.
  * BACKWARDS INCOMPATIBLE: When parsing elliptic curve private
    keys, we now reject keys that incorrectly encode a private
    key of the wrong length because such keys are impossible to
    process in a constant-time manner. We do not believe keys
    with this problem are in wide use, however we may revert this
    change based on the feedback we receive.
  * Deprecated passing 64-bit (8-byte) and 128-bit (16-byte) keys
    to :class:`~cryptography.hazmat.decrepit.ciphers.algorithms.T
    ripleDES`. In a future release, only 192-bit (24-byte) keys
    will be accepted. Users should expand shorter keys themselves
    (e.g., for single DES: key + key + key, for two-key: key +
    key[:8]).
  * Updated the minimum supported Rust version (MSRV) to 1.83.0,
    from 1.74.0.
  * Support for x86_64 macOS (including publishing wheels) is
    deprecated and will be removed in the next release. We will
    switch to publishing an arm64 only wheel for macOS.
  * Support for 32-bit Windows (including publishing wheels) is
    deprecated and will be removed in the next release. Users
    should move to a 64-bit Python installation.
  * public_bytes and private_bytes methods on keys now raise
    TypeError (instead of ValueError) if an invalid encoding is
    provided for the given format.
  * Moved
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.CFB`,
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.OFB`, and
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.CFB8`
    into :doc:`/hazmat/decrepit/index` and deprecated them in the
    modes module. They will be removed from the modes module in
    49.0.0.
  * Moved :class:`~cryptography.hazmat.primitives.ciphers.algorit
    hms.Camellia` into  :doc:`/hazmat/decrepit/index` and
    deprecated it in the cipher module. It will be removed from
    the cipher module in 49.0.0.
  * Added
    :meth:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF.extract`
    to :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF`.
    The previous private implementation will be removed in
    49.0.0.
  * Added support for loading elliptic curve keys that contain
    explicit encodings of the curves secp256r1, secp384r1, and
    secp521r1.
  * Added support for
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2d`
    and
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2i`
    when using OpenSSL 3.2.0+.
  * Added derive_into methods to
    :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF`,
    :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDFExpand`,
    :class:`~cryptography.hazmat.primitives.kdf.concatkdf.ConcatK
    DFHash`, :class:`~cryptography.hazmat.primitives.kdf.concatkd
    f.ConcatKDFHMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2id`,
    :class:`~cryptography.hazmat.primitives.kdf.pbkdf2.PBKDF2HMAC
    `,
    :class:`~cryptography.hazmat.primitives.kdf.kbkdf.KBKDFHMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.kbkdf.KBKDFCMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.scrypt.Scrypt`,
    and
    :class:`~cryptography.hazmat.primitives.kdf.x963kdf.X963KDF`
    to allow deriving keys directly into pre-allocated buffers.
  * Added encrypt_into and decrypt_into methods to
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESCCM`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESGCM`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESGCMSI
    V`, :class:`~cryptography.hazmat.primitives.ciphers.aead.AESO
    CB3`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESSIV`,
    and :class:`~cryptography.hazmat.primitives.ciphers.aead.ChaC
    ha20Poly1305` to allow encrypting directly into a pre-
    allocated buffer.
  * Added support for PKCS1v15 signing without DigestInfo using :
    class:`~cryptography.hazmat.primitives.asymmetric.utils.NoDig
    estInfo`.
  * Added
    :meth:`~cryptography.hazmat.primitives.hashes.Hash.hash`, a
    one-shot method for computing hashes.
  * Added :doc:`/hazmat/primitives/hpke` support implementing RFC
    9180 for hybrid authenticated encryption.
  * Added new :doc:`/hazmat/primitives/asymmetric/mlkem` module
    with support for ML-KEM key encapsulation with AWS-LC and
    BoringSSL. Note: Post-quantum algorithm support requires AWS-
    LC or BoringSSL. As we ship our wheels with OpenSSL, most
    users will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Note: Post-quantum algorithm support requires AWS-LC or
    BoringSSL. As we ship our wheels with OpenSSL, most users
    will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Added new :doc:`/hazmat/primitives/asymmetric/mldsa` module
    with support for ML-DSA signing and verification with AWS-LC
    and BoringSSL. Note: Post-quantum algorithm support requires
    AWS-LC or BoringSSL. As we ship our wheels with OpenSSL, most
    users will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Note: Post-quantum algorithm support requires AWS-LC or
    BoringSSL. As we ship our wheels with OpenSSL, most users
    will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Added new :doc:`/hazmat/asn1/index` module with support for
    declaratively defining custom ASN.1 types and
    encoding/decoding them.
  * Fixed compilation when using LibreSSL 4.3.0 and OpenSSL
    4.0.0.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 4.0.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1778414400">- update to 48.0.0:
  * BACKWARDS INCOMPATIBLE: Support for Python 3.8 has been
    removed. cryptography now requires Python 3.9 or later.
  * BACKWARDS INCOMPATIBLE: Loading an X.509 CRL whose inner
    TBSCertList.signature algorithm does not match the outer
    signatureAlgorithm now raises ValueError. Previously, such
    CRLs were parsed successfully and only rejected during
    signature validation.
  * Added support for :doc:`/hazmat/primitives/asymmetric/mlkem`
    and :doc:`/hazmat/primitives/asymmetric/mldsa` when using
    OpenSSL 3.5.0 or later, in addition to the existing AWS-LC
    and BoringSSL support. This means post-quantum algorithms are
    now available to users of our wheels. Note: Going forward, we
    do not guarantee that all functionality in cryptography will
    be available when building against OpenSSL. See
    :doc:`/statements/state-of-openssl` for more information.
  * Note: Going forward, we do not guarantee that all
    functionality in cryptography will be available when building
    against OpenSSL. See :doc:`/statements/state-of-openssl` for
    more information.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1781438400">- update to 49.0.0:
  * BACKWARDS INCOMPATIBLE: Removed the deprecated
    PUBLIC_KEY_TYPES, PRIVATE_KEY_TYPES,
    CERTIFICATE_PRIVATE_KEY_TYPES,
    CERTIFICATE_ISSUER_PUBLIC_KEY_TYPES, and
    CERTIFICATE_PUBLIC_KEY_TYPES type aliases. Use
    PublicKeyTypes, PrivateKeyTypes,
    CertificateIssuerPrivateKeyTypes,
    CertificateIssuerPublicKeyTypes, and
    CertificatePublicKeyTypes instead. These were deprecated in
    version 40.0.
  * BACKWARDS INCOMPATIBLE: :class:`~cryptography.hazmat.primitiv
    es.ciphers.algorithms.ChaCha20` now treats the first 4 bytes
    of the nonce as a 32-bit little-endian block counter (as
    defined in RFC 7539) and tracks the number of bytes
    processed. Attempting to encrypt or decrypt more data than
    the counter allows before it would overflow now raises a
    :class:`ValueError` rather than silently diverging from RFC
    7539. Setting the counter portion of the nonce to zero allows
    encrypting up to 256 GiB with a given nonce.
  * BACKWARDS INCOMPATIBLE: Loading an X.509 certificate whose
    ECDSA or DSA signature AlgorithmIdentifier contains encoded
    NULL parameters now raises a :class:`ValueError`. Such
    certificates are invalid, but older versions of Java emitted
    them; previously they loaded with a deprecation warning.
  * Fixed cross-compilation of the CFFI bindings when
    PYO3_CROSS_LIB_DIR is set. The build now derives the Python
    include directory from PYO3_CROSS_LIB_DIR instead of querying
    the host interpreter, which previously caused the build to
    fail during cross-compilations for embedded systems, on hosts
    which have same-version Python development headers installed
    as the target Python.
  * Added support for signing and verifying X.509 certificates,
    certificate signing requests, and certificate revocation
    lists with :doc:`/hazmat/primitives/asymmetric/mldsa` keys,
    as well as loading certificates that contain ML-DSA public
    keys.
  * Added
    :meth:`~cryptography.hazmat.primitives.hpke.KEM.enc_length`
    to :class:`~cryptography.hazmat.primitives.hpke.KEM` so
    callers can split the encapsulated key from the ciphertext
    returned by
    :meth:`~cryptography.hazmat.primitives.hpke.Suite.encrypt`.
  * :meth:`~cryptography.x509.verification.ExtensionPolicy.requir
    e_present`, :meth:`~cryptography.x509.verification.ExtensionP
    olicy.may_be_present`, and :meth:`~cryptography.x509.verifica
    tion.ExtensionPolicy.require_not_present` now accept any
    extension type. Previously only a fixed set of extension
    types was supported, which made it impossible to account for
    otherwise unrecognized critical extensions during path
    validation.
  * Added support for using
    :class:`~cryptography.x509.Certificate`,
    :class:`~cryptography.x509.CertificateSigningRequest`, and
    :class:`~cryptography.x509.CertificateRevocationList` as
    field types in :doc:`/hazmat/asn1/index` structures.
  * Added :func:`~cryptography.hazmat.asn1.value_set`, a class
    decorator that registers an :class:`enum.Enum` subclass as an
    ASN.1 value set: members are encoded as their underlying
    value, and decoding fails if the decoded value does not match
    one of the declared members.
  * Added :meth:`~cryptography.x509.Name.from_bytes` for parsing
    a :class:`~cryptography.x509.Name` from DER bytes, the
    inverse of :meth:`~cryptography.x509.Name.public_bytes`.
  * Added the rsa_padding keyword-only parameter to
    :meth:`~cryptography.x509.CertificateBuilder.public_key`.
    Passing the :class:`~cryptography.hazmat.primitives.asymmetri
    c.padding.PSS` class (not an instance) encodes an RSA subject
    public key in the certificate's subjectPublicKeyInfo with the
    id-RSASSA-PSS OID and no parameters.
  * Added external mu (message representative) support to
    :doc:`/hazmat/primitives/asymmetric/mldsa` via the sign_mu
    and verify_mu methods, which sign and verify a precomputed
    64-byte mu as defined in FIPS 204.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 4.0.1.</changelog>
</package>
<package pkgid="7ba32738bc05f39815222dc3c62929d135e4811f231e744b3708ad82210040280b86dfa91d815b60d0f95928ddc5b588a92db452fcc5b0ed740ae9d570e95ad3" name="python314-cryptography-debuginfo" arch="x86_64">
  <version epoch="0" ver="49.0.0" rel="289.3"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1727524800">- update to 43.0.1:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.3.2.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1729598400">- update to 43.0.3:
  * Fixed release metadata for cryptography-vectors
  * Fixed compilation when using LibreSSL 4.0.0.</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1730808000">- Avoid using requires_eq, which after the last modifications
  conflicts with python singlespec (order of expansion).</changelog>
  <changelog author="Ben Greiner &lt;code@bnavigator.de&gt;" date="1731067200">- Fix requires_eq replacement for distributions which do not have
  python3-cffi installed (such as SLE15 python module pythons)
  * gh#openSUSE/python-rpm-macros#185
- Remove outdated section in description</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfyhalomacro@opensuse.org&gt;" date="1737892800">- Update to version 44.0.0:
  * BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL &lt; 3.9.
  * Deprecated Python 3.7 support. Python 3.7 is no longer supported by
    the Python core team. Support for Python 3.7 will be removed in a future
    cryptography release.
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.4.0.
  * macOS wheels are now built against the macOS 10.13 SDK. Users on older
    versions of macOS should upgrade, or they will need to build cryptography
    themselves.
  * Enforce the RFC 5280 requirement that extended key usage extensions must not be empty.
  * Added support for timestamp extraction to the :class:`~cryptography.fernet.MultiFernet` class.
  * Relax the Authority Key Identifier requirements on root CA certificates
    during X.509 verification to allow fields permitted by RFC 5280 but
    forbidden by the CA/Browser BRs.
  * Added support for
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2id` when using
    OpenSSL 3.2.0+.
  * Added support for the :class:`~cryptography.x509.Admissions` certificate extension.
  * Added basic support for PKCS7 decryption (including S/MIME 3.2) via
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der`,
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_pem`,
    and :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_smime`.
- Update specfile to accommodate new project structure at version 44.0.0
- Update no-pytest_benchmark.patch</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1740571200">- update to 44.0.1:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.4.1.
  * We now build armv7l manylinux wheels and publish them to
    PyPI.
  * We now build manylinux_2_34 wheels and publish them to PyPI.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1742731200">- update to 44.0.2:
  * We now build wheels for PyPy 3.11.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1746619200">- Update to 44.0.3
  * Fixed compilation when using LibreSSL 4.1.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1752321600">- update to 45.0.5:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.1.
  * Fixed decrypting PKCS#8 files encrypted with SHA1-RC4. (This
    is not considered secure, and is supported only for backwards
    compatibility.)
  * Fixed decrypting PKCS#8 files encrypted with long salts (this
    impacts keys encrypted by Bouncy Castle).
  * Fixed decrypting PKCS#8 files encrypted with DES-CBC-MD5.
    While wildly insecure, this remains prevalent.
  * Fixed using mypy with cryptography on older versions of
    Python.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.0.
  * Support for Python 3.7 is deprecated and will be removed in
    the next cryptography release.
  * Updated the minimum supported Rust version (MSRV) to 1.74.0,
    from 1.65.0.
  * Added support for serialization of PKCS#12 Java truststores
    in :func:`~cryptography.hazmat.primitives.serialization.pkcs1
    2.serialize_java_truststore`
  * Added :meth:`~cryptography.hazmat.primitives.kdf.argon2.Argon
    2id.derive_phc_encoded` and :meth:`~cryptography.hazmat.primi
    tives.kdf.argon2.Argon2id.verify_phc_encoded` methods to
    support password hashing in the PHC string format
  * Added support for PKCS7 decryption and encryption using
    AES-256 as the content algorithm, in addition to AES-128.
  * BACKWARDS INCOMPATIBLE: Made SSH private key loading more
    consistent with other private key loading: :func:`~cryptograp
    hy.hazmat.primitives.serialization.load_ssh_private_key` now
    raises a TypeError if the key is unencrypted but a password
    is provided (previously no exception was raised), and raises
    a TypeError if the key is encrypted but no password is
    provided (previously a ValueError was raised).
  * Added __copy__ to the :class:`~cryptography.hazmat.primitives
    .asymmetric.ec.EllipticCurvePrivateKey`, :class:`~cryptograph
    y.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey`, :c
    lass:`~cryptography.hazmat.primitives.asymmetric.ed25519.Ed25
    519PublicKey`, :class:`~cryptography.hazmat.primitives.asymme
    tric.ed25519.Ed25519PrivateKey`, :class:`~cryptography.hazmat
    .primitives.asymmetric.ed448.Ed448PublicKey`, :class:`~crypto
    graphy.hazmat.primitives.asymmetric.ed448.Ed448PrivateKey`, :
    class:`~cryptography.hazmat.primitives.asymmetric.x25519.X255
    19PublicKey`, :class:`~cryptography.hazmat.primitives.asymmet
    ric.x25519.X25519PrivateKey`, :class:`~cryptography.hazmat.pr
    imitives.asymmetric.x448.X448PublicKey`, :class:`~cryptograph
    y.hazmat.primitives.asymmetric.x448.X448PrivateKey`, :class:`
    ~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey`
    , :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAP
    ublicKey`, :class:`~cryptography.hazmat.primitives.asymmetric
    .dsa.DSAPrivateKey`, :class:`~cryptography.hazmat.primitives.
    asymmetric.dsa.DSAPublicKey`, :class:`~cryptography.hazmat.pr
    imitives.asymmetric.dh.DHPrivateKey`, and :class:`~cryptograp
    hy.hazmat.primitives.asymmetric.dh.DHPublicKey` abstract base
    classes.
  * We significantly refactored how private key loading ( :func:`
    ~cryptography.hazmat.primitives.serialization.load_pem_privat
    e_key` and :func:`~cryptography.hazmat.primitives.serializati
    on.load_der_private_key`) works. This is intended to be
    backwards compatible for all well-formed keys, therefore if
    you discover a key that now raises an exception, please file
    a bug with instructions for reproducing.
  * Added unsafe_skip_rsa_key_validation keyword-argument to :fun
    c:`~cryptography.hazmat.primitives.serialization.load_ssh_pri
    vate_key`.
  * Added :class:`~cryptography.hazmat.primitives.hashes.XOFHash`
    to support repeated :meth:`~cryptography.hazmat.primitives.ha
    shes.XOFHash.squeeze` operations on extendable output
    functions.
  * Added :meth:`~cryptography.x509.ocsp.OCSPResponseBuilder.add_
    response_by_hash` method to allow creating OCSP responses
    using certificate hash values rather than full certificates.
  * Extended the :mod:`X.509 path validation
    &lt;cryptography.x509.verification&gt;` API to support user-
    configured extension policies via the
    :meth:`PolicyBuilder.extension_policies &lt;cryptography.x509.ve
    rification.PolicyBuilder.extension_policies&gt;` method.
  * Deprecated the subject, verification_time and max_chain_depth
    properties on
    :class:`~cryptography.x509.verification.ClientVerifier` and
    :class:`~cryptography.x509.verification.ServerVerifier` in
    favor of a new policy property. These properties will be
    removed in the next release of cryptography.
  * BACKWARDS INCOMPATIBLE: The :meth:`VerifiedClient.subject
    &lt;cryptography.x509.verification.VerifiedClient.subjects&gt;`
    property can now be None since a custom extension policy may
    allow certificates without a Subject Alternative Name
    extension.
  * Changed the behavior when the OpenSSL 3 legacy provider fails
    to load. Instead of raising an exception, a warning is now
    emitted. The CRYPTOGRAPHY_OPENSSL_NO_LEGACY environment
    variable can still be used to disable the legacy provider at
    runtime.
  * Added support for the CRYPTOGRAPHY_BUILD_OPENSSL_NO_LEGACY
    environment variable during build time, which prevents the
    library from ever attempting to load the legacy provider.
  * Added support for the
    :class:`~cryptography.x509.PrivateKeyUsagePeriod` X.509
    extension. This extension defines the period during which the
    private key corresponding to the certificate's public key may
    be used.
  * Added support for compiling against `aws-lc`_.
  * Parsing X.509 structures now more strictly enforces that Name
    structures do not have malformed ASN.1.
  * We now publish py311 wheels that utilize the faster
    pyo3::buffer::PyBuffer interface, resulting in significantly
    improved performance for operations involving small buffers.
  * Added :func:`~cryptography.hazmat.primitives.serialization.ss
    h_key_fingerprint` for computing fingerprints of SSH public
    keys.
  * Added support for deterministic ECDSA signing via the new
    keyword-only argument ecdsa_deterministic in
    :meth:`~cryptography.x509.CertificateBuilder.sign`, :meth:`~c
    ryptography.x509.CertificateRevocationListBuilder.sign` and :
    meth:`~cryptography.x509.CertificateSigningRequestBuilder.sig
    n`.</changelog>
  <changelog author="James Oakley &lt;jfunk@opensuse.org&gt;" date="1756728000">- Add Make-unsafe-subinterpreter-support-available-via-cfg.patch
  to allow ceph-mgr to load modules (boo#1248987)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1757851200">- update to 45.0.7:
  * Added a function to support an upcoming pyOpenSSL release.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1760356800">- update to 46.0.2:
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.4.
  * Fixed an issue where users installing via pip on Python 3.14
    development versions would not properly install a dependency.
  * Fixed an issue building the free-threaded macOS 3.14 wheels.
  * BACKWARDS INCOMPATIBLE: Support for Python 3.7 has been
    removed.
  * Support for OpenSSL &lt; 3.0 is deprecated and will be removed
    in the next release.
  * Support for x86_64 macOS (including publishing wheels) is
    deprecated and will be removed in two releases. We will
    switch to publishing an arm64 only wheel for macOS.
  * Support for 32-bit Windows (including publishing wheels) is
    deprecated and will be removed in two releases. Users should
    move to a 64-bit Python installation.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 3.5.3.
  * We now build ppc64le manylinux wheels and publish them to
    PyPI.
  * We now build win_arm64 (Windows on Arm) wheels and publish
    them to PyPI.
  * Added support for free-threaded Python 3.14.
  * Removed the deprecated get_attribute_for_oid method on
    :class:`~cryptography.x509.CertificateSigningRequest`. Users
    should use
    :meth:`~cryptography.x509.Attributes.get_attribute_for_oid`
    instead.
  * Removed the deprecated CAST5, SEED, IDEA, and Blowfish
    classes from the cipher module. These are still available in
    :doc:`/hazmat/decrepit/index`.
  * In X.509, when performing a PSS signature with a SHA-3 hash,
    it is now encoded with the official NIST SHA3 OID.</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1765195200">- Only require pytest-subtests with pytest &lt; 9.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1770897600">- Update to 46.0.5 (fixes CVE-2026-26007, bsc#1258074)
  * An attacker could create a malicious public key that reveals portions of
    your private key when using certain uncommon elliptic curves (binary
    curves). This version now includes additional security checks to prevent
    this attack. This issue only affects binary elliptic curves, which are
    rarely used in real-world applications. Credit to XlabAI Team of Tencent
    Xuanwu Lab and Atuin Automated Vulnerability Discovery Engine for reporting
    the issue. CVE-2026-26007
  * Support for SECT* binary elliptic curves is deprecated and will be removed
    in the next release.
- Update to 46.0.4
  * Dropped support for win_arm64 wheels.
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.5.
- Update to 46.0.3
  * Fixed compilation when using LibreSSL 4.2.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1774612800">- update to 46.0.6 (CVE-2026-34073, bsc#1260876):
  * SECURITY ISSUE: Fixed a bug where name constraints were not
    applied to peer names during verification when the leaf
    certificate contains a wildcard DNS SAN. Ordinary X.509
    topologies are not affected by this bug, including those used
    by the Web PKI. Credit to Oleh Konko (1seal) for reporting
    the issue. CVE-2026-34073</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1774958400">- Add patch support-maturin-1.12.patch:
  * Correctly deal with maturin bugfix that installs tests and
    docs under sitearch.</changelog>
  <changelog author="Nico Krapp &lt;nico.krapp@suse.com&gt;" date="1775822400">- Update to 46.0.7 (fixes CVE-2026-39892, bsc#1261863)
  * **SECURITY ISSUE**: Fixed an issue where non-contiguous buffers could be
    passed to APIs that accept Python buffers, which could lead to buffer
    overflow. **CVE-2026-39892**
  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.6.
- drop support-maturin-1.12.patch (upstream)
- drop no-pytest_benchmark.patch,
  Make-unsafe-subinterpreter-support-available-via-cfg.patch:
  obsolete</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1777204800">- update to 47.0.0:
  * Support for Python 3.8 is deprecated and will be removed in
    the next cryptography release.
  * BACKWARDS INCOMPATIBLE: Support for binary elliptic curves
    (SECT* classes) has been removed. These curves are rarely
    used and have additional security considerations that make
    them undesirable.
  * BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.1.x has been
    removed. OpenSSL 3.0.0 or later is now required. LibreSSL,
    BoringSSL, and AWS-LC continue to be supported.
  * BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL &lt; 4.1.
  * BACKWARDS INCOMPATIBLE: Loading keys with unsupported
    algorithms or keys with unsupported explicit curve encodings
    now raises
    :class:`~cryptography.exceptions.UnsupportedAlgorithm`
    instead of ValueError. This change affects :func:`~cryptograp
    hy.hazmat.primitives.serialization.load_pem_private_key`, :fu
    nc:`~cryptography.hazmat.primitives.serialization.load_der_pr
    ivate_key`, :func:`~cryptography.hazmat.primitives.serializat
    ion.load_pem_public_key`, :func:`~cryptography.hazmat.primiti
    ves.serialization.load_der_public_key`, and
    :meth:`~cryptography.x509.Certificate.public_key` when called
    on certificates with unsupported public key algorithms.
  * BACKWARDS INCOMPATIBLE: When parsing elliptic curve private
    keys, we now reject keys that incorrectly encode a private
    key of the wrong length because such keys are impossible to
    process in a constant-time manner. We do not believe keys
    with this problem are in wide use, however we may revert this
    change based on the feedback we receive.
  * Deprecated passing 64-bit (8-byte) and 128-bit (16-byte) keys
    to :class:`~cryptography.hazmat.decrepit.ciphers.algorithms.T
    ripleDES`. In a future release, only 192-bit (24-byte) keys
    will be accepted. Users should expand shorter keys themselves
    (e.g., for single DES: key + key + key, for two-key: key +
    key[:8]).
  * Updated the minimum supported Rust version (MSRV) to 1.83.0,
    from 1.74.0.
  * Support for x86_64 macOS (including publishing wheels) is
    deprecated and will be removed in the next release. We will
    switch to publishing an arm64 only wheel for macOS.
  * Support for 32-bit Windows (including publishing wheels) is
    deprecated and will be removed in the next release. Users
    should move to a 64-bit Python installation.
  * public_bytes and private_bytes methods on keys now raise
    TypeError (instead of ValueError) if an invalid encoding is
    provided for the given format.
  * Moved
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.CFB`,
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.OFB`, and
    :class:`~cryptography.hazmat.decrepit.ciphers.modes.CFB8`
    into :doc:`/hazmat/decrepit/index` and deprecated them in the
    modes module. They will be removed from the modes module in
    49.0.0.
  * Moved :class:`~cryptography.hazmat.primitives.ciphers.algorit
    hms.Camellia` into  :doc:`/hazmat/decrepit/index` and
    deprecated it in the cipher module. It will be removed from
    the cipher module in 49.0.0.
  * Added
    :meth:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF.extract`
    to :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF`.
    The previous private implementation will be removed in
    49.0.0.
  * Added support for loading elliptic curve keys that contain
    explicit encodings of the curves secp256r1, secp384r1, and
    secp521r1.
  * Added support for
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2d`
    and
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2i`
    when using OpenSSL 3.2.0+.
  * Added derive_into methods to
    :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDF`,
    :class:`~cryptography.hazmat.primitives.kdf.hkdf.HKDFExpand`,
    :class:`~cryptography.hazmat.primitives.kdf.concatkdf.ConcatK
    DFHash`, :class:`~cryptography.hazmat.primitives.kdf.concatkd
    f.ConcatKDFHMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2id`,
    :class:`~cryptography.hazmat.primitives.kdf.pbkdf2.PBKDF2HMAC
    `,
    :class:`~cryptography.hazmat.primitives.kdf.kbkdf.KBKDFHMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.kbkdf.KBKDFCMAC`,
    :class:`~cryptography.hazmat.primitives.kdf.scrypt.Scrypt`,
    and
    :class:`~cryptography.hazmat.primitives.kdf.x963kdf.X963KDF`
    to allow deriving keys directly into pre-allocated buffers.
  * Added encrypt_into and decrypt_into methods to
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESCCM`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESGCM`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESGCMSI
    V`, :class:`~cryptography.hazmat.primitives.ciphers.aead.AESO
    CB3`,
    :class:`~cryptography.hazmat.primitives.ciphers.aead.AESSIV`,
    and :class:`~cryptography.hazmat.primitives.ciphers.aead.ChaC
    ha20Poly1305` to allow encrypting directly into a pre-
    allocated buffer.
  * Added support for PKCS1v15 signing without DigestInfo using :
    class:`~cryptography.hazmat.primitives.asymmetric.utils.NoDig
    estInfo`.
  * Added
    :meth:`~cryptography.hazmat.primitives.hashes.Hash.hash`, a
    one-shot method for computing hashes.
  * Added :doc:`/hazmat/primitives/hpke` support implementing RFC
    9180 for hybrid authenticated encryption.
  * Added new :doc:`/hazmat/primitives/asymmetric/mlkem` module
    with support for ML-KEM key encapsulation with AWS-LC and
    BoringSSL. Note: Post-quantum algorithm support requires AWS-
    LC or BoringSSL. As we ship our wheels with OpenSSL, most
    users will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Note: Post-quantum algorithm support requires AWS-LC or
    BoringSSL. As we ship our wheels with OpenSSL, most users
    will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Added new :doc:`/hazmat/primitives/asymmetric/mldsa` module
    with support for ML-DSA signing and verification with AWS-LC
    and BoringSSL. Note: Post-quantum algorithm support requires
    AWS-LC or BoringSSL. As we ship our wheels with OpenSSL, most
    users will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Note: Post-quantum algorithm support requires AWS-LC or
    BoringSSL. As we ship our wheels with OpenSSL, most users
    will not have access to these APIs yet. See
    :doc:`/statements/state-of-openssl` for more information on
    OpenSSL support.
  * Added new :doc:`/hazmat/asn1/index` module with support for
    declaratively defining custom ASN.1 types and
    encoding/decoding them.
  * Fixed compilation when using LibreSSL 4.3.0 and OpenSSL
    4.0.0.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 4.0.0.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1778414400">- update to 48.0.0:
  * BACKWARDS INCOMPATIBLE: Support for Python 3.8 has been
    removed. cryptography now requires Python 3.9 or later.
  * BACKWARDS INCOMPATIBLE: Loading an X.509 CRL whose inner
    TBSCertList.signature algorithm does not match the outer
    signatureAlgorithm now raises ValueError. Previously, such
    CRLs were parsed successfully and only rejected during
    signature validation.
  * Added support for :doc:`/hazmat/primitives/asymmetric/mlkem`
    and :doc:`/hazmat/primitives/asymmetric/mldsa` when using
    OpenSSL 3.5.0 or later, in addition to the existing AWS-LC
    and BoringSSL support. This means post-quantum algorithms are
    now available to users of our wheels. Note: Going forward, we
    do not guarantee that all functionality in cryptography will
    be available when building against OpenSSL. See
    :doc:`/statements/state-of-openssl` for more information.
  * Note: Going forward, we do not guarantee that all
    functionality in cryptography will be available when building
    against OpenSSL. See :doc:`/statements/state-of-openssl` for
    more information.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1781438400">- update to 49.0.0:
  * BACKWARDS INCOMPATIBLE: Removed the deprecated
    PUBLIC_KEY_TYPES, PRIVATE_KEY_TYPES,
    CERTIFICATE_PRIVATE_KEY_TYPES,
    CERTIFICATE_ISSUER_PUBLIC_KEY_TYPES, and
    CERTIFICATE_PUBLIC_KEY_TYPES type aliases. Use
    PublicKeyTypes, PrivateKeyTypes,
    CertificateIssuerPrivateKeyTypes,
    CertificateIssuerPublicKeyTypes, and
    CertificatePublicKeyTypes instead. These were deprecated in
    version 40.0.
  * BACKWARDS INCOMPATIBLE: :class:`~cryptography.hazmat.primitiv
    es.ciphers.algorithms.ChaCha20` now treats the first 4 bytes
    of the nonce as a 32-bit little-endian block counter (as
    defined in RFC 7539) and tracks the number of bytes
    processed. Attempting to encrypt or decrypt more data than
    the counter allows before it would overflow now raises a
    :class:`ValueError` rather than silently diverging from RFC
    7539. Setting the counter portion of the nonce to zero allows
    encrypting up to 256 GiB with a given nonce.
  * BACKWARDS INCOMPATIBLE: Loading an X.509 certificate whose
    ECDSA or DSA signature AlgorithmIdentifier contains encoded
    NULL parameters now raises a :class:`ValueError`. Such
    certificates are invalid, but older versions of Java emitted
    them; previously they loaded with a deprecation warning.
  * Fixed cross-compilation of the CFFI bindings when
    PYO3_CROSS_LIB_DIR is set. The build now derives the Python
    include directory from PYO3_CROSS_LIB_DIR instead of querying
    the host interpreter, which previously caused the build to
    fail during cross-compilations for embedded systems, on hosts
    which have same-version Python development headers installed
    as the target Python.
  * Added support for signing and verifying X.509 certificates,
    certificate signing requests, and certificate revocation
    lists with :doc:`/hazmat/primitives/asymmetric/mldsa` keys,
    as well as loading certificates that contain ML-DSA public
    keys.
  * Added
    :meth:`~cryptography.hazmat.primitives.hpke.KEM.enc_length`
    to :class:`~cryptography.hazmat.primitives.hpke.KEM` so
    callers can split the encapsulated key from the ciphertext
    returned by
    :meth:`~cryptography.hazmat.primitives.hpke.Suite.encrypt`.
  * :meth:`~cryptography.x509.verification.ExtensionPolicy.requir
    e_present`, :meth:`~cryptography.x509.verification.ExtensionP
    olicy.may_be_present`, and :meth:`~cryptography.x509.verifica
    tion.ExtensionPolicy.require_not_present` now accept any
    extension type. Previously only a fixed set of extension
    types was supported, which made it impossible to account for
    otherwise unrecognized critical extensions during path
    validation.
  * Added support for using
    :class:`~cryptography.x509.Certificate`,
    :class:`~cryptography.x509.CertificateSigningRequest`, and
    :class:`~cryptography.x509.CertificateRevocationList` as
    field types in :doc:`/hazmat/asn1/index` structures.
  * Added :func:`~cryptography.hazmat.asn1.value_set`, a class
    decorator that registers an :class:`enum.Enum` subclass as an
    ASN.1 value set: members are encoded as their underlying
    value, and decoding fails if the decoded value does not match
    one of the declared members.
  * Added :meth:`~cryptography.x509.Name.from_bytes` for parsing
    a :class:`~cryptography.x509.Name` from DER bytes, the
    inverse of :meth:`~cryptography.x509.Name.public_bytes`.
  * Added the rsa_padding keyword-only parameter to
    :meth:`~cryptography.x509.CertificateBuilder.public_key`.
    Passing the :class:`~cryptography.hazmat.primitives.asymmetri
    c.padding.PSS` class (not an instance) encodes an RSA subject
    public key in the certificate's subjectPublicKeyInfo with the
    id-RSASSA-PSS OID and no parameters.
  * Added external mu (message representative) support to
    :doc:`/hazmat/primitives/asymmetric/mldsa` via the sign_mu
    and verify_mu methods, which sign and verify a precomputed
    64-byte mu as defined in FIPS 204.
  * Updated Windows, macOS, and Linux wheels to be compiled with
    OpenSSL 4.0.1.</changelog>
</package>
<package pkgid="1e2a327ed04c262cd436eb29a70b8f7c0346bf663dceb30d01ef949443f49d9a96709d178c7b3395921141e6c5dc20bc830f01a11b78b8ec10f73347b4ae966d" name="python314-libnacl" arch="noarch">
  <version epoch="0" ver="2.1.0" rel="63.13"/>
  <changelog author="tchvatal@suse.com" date="1533902400">- Fix the libsodium dependency on the runtime to be copied by macros
- Install license file</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1571054400">- Replace %fdupes -s with plain %fdupes; hardlinks are better.</changelog>
  <changelog author="Ond&#x159;ej S&#xFA;kup &lt;mimi.vx@gmail.com&gt;" date="1583236800">- update to 1.7.1
  * Bindings for kdf in libsodium
  * Added extra key validation
  * Add Crypto_box_easy</changelog>
  <changelog author="Niels Abspoel &lt;aboe76@gmail.com&gt;" date="1612180800">- Update to 1.7.2
  * remove encoding parameter json.loads for python 3.9 compatibility
  * implement functions for equal-comparison and hashing keys
  * improved spec file</changelog>
  <changelog author="Niels Abspoel &lt;aboe76@gmail.com&gt;" date="1613649600">- Revert libsodium requirement back to libsodium23</changelog>
  <changelog author="Niels Abspoel &lt;aboe76@gmail.com&gt;" date="1623412800">- add crypto_kdf_derive.patch to fix crypto_kdf_derive_from_key() on 32-bit platforms</changelog>
  <changelog author="ecsos &lt;ecsos@opensuse.org&gt;" date="1688558400">- Add %{?sle15_python_module_pythons}</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1709294400">- Update to 2.1.0:
  * Added classes to the libnacl.aead module allowing for the use of
    XChaCha20-Poly1305-IETF, ChaCha20-Poly1305-IETF, and AES256-GCM.
  * Added the libnacl.kx module. This module contains the ExchangeKey class.
- Switch to autosetup and pyproject macros.
- Drop patch crypto_kdf_derive.patch, no longer required.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1718193600">- update to libsodium26</changelog>
  <changelog author="Max Lin &lt;mlin@suse.com&gt;" date="1755864000">- Use BuildRequires: poetry-core to instead of BuildRequires: poetry</changelog>
</package>
<package pkgid="7a8448d2fd503b671c4271d06f9713a60834e26707e1378db10c37c0ed61098a8b8e334b774e8b9d5b3a533dccf288314d02423efc50b59f529dbb6970c3ef2f" name="python314-logutils" arch="noarch">
  <version epoch="0" ver="0.3.5" rel="30.30"/>
  <changelog author="speilicke@suse.com" date="1374148800">- Initial version</changelog>
  <changelog author="tbechtold@suse.com" date="1498737600">- update to 0.3.5:
  - Bring QueueListener implementation in line with the version in the stdlib.
  - Fixed a bug in ColorizingStreamHandler relating to encoding.
  - Return non-zero error code from "setup.py test" when a test fails.
  - Make the dictConfig tests work with both Python 2.x and 3.x.
- convert to singlespec
- fix Source url
- split -doc package
- update Url</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1543924800">- Remove superfluous devel dependency for noarch package</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1622894400">- add sphinx4.patch to enable build with Sphinx 4.x</changelog>
  <changelog author="pgajdos@suse.com" date="1630497600">- %check: use %pyunittest rpm macro</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1676635200">- update path for SLE15</changelog>
  <changelog author="Ben Greiner &lt;code@bnavigator.de&gt;" date="1705579200">- Add logutils-pr1-fix-testasserts-py3.12.patch
  * https://bitbucket.org/vinay.sajip/logutils/pull-requests/1
  * Fixes the test suite. This package is really old but still
    half-maintained
- Switch to PEP517
- Deduplicate files</changelog>
  <changelog author="Christoph G &lt;foss@grueninger.de&gt;" date="1725537600">- Add patch logutils-intersphinx.patch to fix compatibility
  with recent Sphinx</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1725969600">- Add patch use-logging-lock-directly.patch:
  * Use logging._lock as a context manager.
- Switch to autosetup macro.</changelog>
</package>
</otherdata>